Improper Neutralization of Formula Elements in a CSV File in Kimai 2

HIGH 7.8CVE-2021-43515 · GHSA-64fq-9c6w-rq44 · Published 08/04/2022 · updated 17/06/2026

In short

CVE-2021-43515 is a HIGH (CVSS 7.8) vulnerability affecting kevinpapst/kimai2, kimai (kimai).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.3% of all vulnerabilities.
Fix: update to 1.14.1 or later.

Package	Affected versions	Patched versions
kevinpapst/kimai2 Packagist	`< 1.14.1`	`1.14.1`
kimai kimai	`< 1.14.1`	`1.14.1`

Description

A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.

NVD description

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.

References

nvd.nist.gov/vuln/detail/CVE-2021-43515 · ADVISORY
kevinpapst/kimai2#2532 · WEB
kevinpapst/kimai2 commit dad1b8b · WEB
kevinpapst/kimai2 · PACKAGE

More vulnerabilities in kevinpapst/kimai2

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

kevinpapst/kimai2

Packagist

< 1.14.1

1.14.1

kimai

< 1.14.1

1.14.1

Description

A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.

NVD description

More vulnerabilities in kevinpapst/kimai2

See all →