CVE-2026-49865 Overview
Kimai, an open-source time tracking application, contains a server-side request forgery (SSRF) vulnerability in its invoice PDF preview and generation workflow. Versions prior to 2.58.0 allow attackers who control Markdown content rendered into invoice PDFs, such as Customer.invoiceText, to force the server to fetch remote image URLs embedded in Markdown image syntax. The application server issues outbound requests to attacker-controlled or internal targets during PDF rendering. Version 2.58.0 patches the issue.
Critical Impact
Authenticated attackers can coerce the Kimai server into making outbound HTTP requests to internal network resources, enabling reconnaissance and reachability probing of otherwise inaccessible services.
Affected Products
- Kimai time tracking application versions prior to 2.58.0
- Deployments exposing invoice PDF preview or generation functionality
- Installations where users can edit Customer.invoiceText or other Markdown-rendered invoice fields
Discovery Timeline
- 2026-09-11 - CVE-2026-49865 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-49865
Vulnerability Analysis
The vulnerability [CWE-918] resides in Kimai's server-side PDF rendering pipeline for invoices. When an invoice is previewed or generated, the renderer processes Markdown content from fields such as Customer.invoiceText. Markdown image syntax embedded in this content causes the renderer to perform outbound HTTP requests to fetch the referenced image resource.
Because these requests originate from the Kimai application server, they inherit its network position. An attacker who can insert Markdown into an invoice field can direct the server to contact arbitrary URLs, including private RFC1918 addresses, cloud metadata endpoints, and internal service ports that are not reachable from the public internet.
The impact scope extends beyond simple outbound probing. Response timing and error differentiation can reveal internal host and port reachability. Follow-on exploitation depends on the accessible internal services and the deployment environment.
Root Cause
The root cause is unrestricted outbound URL fetching during Markdown-to-PDF rendering. The PDF renderer resolves remote image references without validating destination hosts, blocking private address ranges, or restricting protocols and ports.
Attack Vector
An authenticated user with permission to modify invoice-related fields such as Customer.invoiceText injects Markdown image syntax pointing at a target URL. When an invoice PDF is previewed or generated, the server dereferences the URL and issues the outbound request. Targets may include internal admin panels, cloud instance metadata services, or unauthenticated internal APIs.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory for technical detail.
Detection Methods for CVE-2026-49865
Indicators of Compromise
- Outbound HTTP requests from the Kimai application server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses such as 169.254.169.254.
- Invoice records containing Markdown image references () pointing to non-image or internal hosts.
- Anomalous PDF preview or generation requests correlated with outbound traffic to unusual destinations.
Detection Strategies
- Inspect Customer.invoiceText and related invoice Markdown fields for image syntax referencing IP addresses, internal hostnames, or non-image content types.
- Monitor egress traffic from the Kimai server and alert on connections to private, loopback, or metadata endpoints during PDF rendering events.
- Correlate application logs of /invoice/preview and generation endpoints with concurrent outbound network flows.
Monitoring Recommendations
- Enable verbose logging on the Kimai PDF renderer to capture fetched URLs and response codes.
- Deploy an egress proxy that logs and restricts destinations reachable from the Kimai host.
- Alert on repeated outbound requests originating from PDF rendering worker processes.
How to Mitigate CVE-2026-49865
Immediate Actions Required
- Upgrade Kimai to version 2.58.0 or later, which patches the SSRF in the invoice PDF workflow.
- Audit existing customer and invoice records for Markdown image references pointing to internal or suspicious hosts.
- Restrict which user roles can modify invoice text fields until the upgrade is complete.
Patch Information
Kimai version 2.58.0 remediates the vulnerability by preventing the PDF renderer from fetching remote resources referenced in Markdown image syntax. Details are available in the GitHub Security Advisory GHSA-pj8j-p4g4-4vw8.
Workarounds
- Block outbound traffic from the Kimai application server to internal networks, loopback addresses, and cloud metadata endpoints using host or network firewall rules.
- Route the Kimai server's outbound HTTP traffic through an egress proxy that enforces an allowlist of permitted destinations.
- Disable or restrict invoice PDF preview and generation until the patched version is deployed.
# Example iptables egress restriction blocking Kimai server from reaching internal ranges
iptables -A OUTPUT -m owner --uid-owner kimai -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner kimai -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner kimai -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner kimai -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
