Remote Code Execution/Server Side Template Injection

kimai/kimai is vulnerable to Remote Code Execution. The vulnerability is caused by Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. A malicious user can upload a specially crafted Twig file to execute arbitrary code when PDF and HTML rendering functionality...