PT-2026-41507

Summary Kimai's Twig sandbox StrictPolicy, used for admin-uploaded invoice and export templates allow-lists the config Twig function with no key filtering. configname delegates to AppConfigurationSystemConfiguration::find$name, which returns arbitrary entries from the flattened kimai.config...