How severe is CVE-2026-49865?

No CVSS score has been assigned to CVE-2026-49865 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-49865?

CVE-2026-49865 affects the following packages: kimai/kimai (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2026-49865?

Update kimai/kimai to 2.58.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49865 is resolved across your whole dependency graph.

How do I detect CVE-2026-49865 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kimai/kimai. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate CVE-2026-49865 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against CVE-2026-49865?

O3 pinpoints whether CVE-2026-49865 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is CVE-2026-49865 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-49865 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-49865 published, and has it been updated?

CVE-2026-49865 was published on July 10, 2026 and was last updated on July 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

CVE-2026-49865

CVE-2026-49865 is a security vulnerability in kimai/kimai. O3 Security confirms whether CVE-2026-49865 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Published

Jul 10, 2026

Updated

Jul 10, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jul 10, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐘kimai/kimai

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax.

This allows the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering. The behavior can be used for internal network probing, server-side reachability checks, and potentially follow-on exploitation depending on deployment environment and accessible internal services.

Details

The vulnerable behavior occurs in the invoice rendering chain when user-controlled Markdown is transformed into HTML and then rendered by mPDF.

First, customer invoice text is copied into the invoice model. . Second, the default PDF invoice template renders that field through the Markdown-to-HTML filter.
Third, md2html enables full Markdown rendering.
Although safe mode is enabled, the tested Markdown image syntax still survives into the rendered HTML chain in a form that causes the PDF renderer to fetch the image resource.
Finally, the HTML is handed to mPDF.

The live test confirms that mPDF attempts to retrieve the remote image URL from the server side during PDF preview. This means the issue is not a template-injection problem but an SSRF condition caused by the rendering pipeline:

attacker-controlled Markdown
Markdown converted to HTML
HTML rendered by mPDF
mPDF fetches remote image resources from the server side

A PoC was provided, but removed for security reasons.

Impact

This vulnerability allows an attacker who can influence invoice-rendered Markdown fields to cause the Kimai server to make outbound requests to arbitrary destinations. In real deployments, this can be used to probe internal services, test access to internal administrative or metadata endpoints, and confirm server-side reachability to attacker-controlled infrastructure.

Depending on the environment, SSRF can also become a stepping stone toward more serious outcomes, such as triggering side effects on internal HTTP services or extracting sensitive information from services reachable only by the server. Because invoice generation is commonly performed by administrative or finance-related users, the feature is realistically reachable in business workflows.

Solution

Kimai does not allow to use markdown images any longer and converts them to HTML links instead
Kimai uses a specialized HttpClient for mPDF (called NoPrivateNetworkHttpClient), which prevents access to a variety of URLs, the full list can be fetched from the documentation
This change can be a BC break, if someone used
- the Kimai domain for hosting invoice or export template images
- an internal IP for hosting invoice or export template images

See https://www.kimai.org/en/security/ghsa-pj8j-p4g4-4vw8

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`kimai/kimai`	all versions	2.58.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kimai/kimai. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update kimai/kimai to 2.58.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49865 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-49865 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2026-49865. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as `Customer.invoiceText`, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax. This allows the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering. The behavior can be used for internal network probing, server-side reachability checks, and potentially follow-on exploitation d

O3 Security · Impact-Aware SCA

Is CVE-2026-49865 in your dependencies?

O3 detects CVE-2026-49865 across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works