Loading vulnerability…
CVE-2026-49865 is a server-side request forgery vulnerability in Kimai affecting invoice PDF preview and generation. The issue arises when attacker-controlled Markdown content rendered into invoices includes image URLs that are processed through the Markdown-to-HTML rendering pipeline and then fetched by mPDF during PDF generation. By supplying crafted remote image references in invoice-rendered Markdown fields, an attacker can induce the Kimai server to initiate outbound requests to arbitrary destinations, including internal network resources that are not directly reachable by the attacker.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a Python-based exploit toolkit for Kimai CVE-2026-52824, an authentication bypass/account takeover issue caused by the default APP_SECRET value and predictable Symfony remember-me cookie signing in Kimai <= 2.57.0. The main exploit logic is in exploit.py, which forges a KIMAI_REMEMBER cookie for an arbitrary username by computing a constant fields hash from SHA256('') and an HMAC-SHA256 using the known secret "change_this_to_something_unique". Successful use yields authenticated access as the targeted user, commonly admin or super_admin. Repository structure: exploit.py is the single-target exploit; batch_pwn.py performs multithreaded exploitation against many URLs; deep_probe.py and probe_batch.py are version/vulnerability detection utilities; quick_scan.py chains discovery, probing, and cookie generation into a multi-stage workflow; shodan-scanner.py discovers Kimai instances via Shodan queries and optional HTTP probing. requirements.txt lists requests and shodan. README.md documents the vulnerability, usage, and workflow. Main capabilities observed: (1) forge valid remember-me cookies for arbitrary usernames, (2) attempt authenticated access to target Kimai instances over HTTP/HTTPS, (3) identify Kimai instances by checking page content and login indicators, (4) probe multiple version disclosure endpoints such as /api/ping, /version, /api/version, /composer.json, /CHANGELOG.md, and /public/build/manifest.json, (5) batch process host lists and save vulnerable/exploited results, and (6) enumerate potential targets using Shodan title/body/favicon searches. Notable implementation details: TLS verification is commonly disabled in the scanners/exploit helpers; batch_pwn.py precomputes one forged cookie and reuses it across hosts; quick_scan.py contains a hardcoded local working directory for invoking exploit.py; deep_probe.py includes a minor code quality issue (datetime imported only at runtime before main save path usage), but the repository overall clearly contains functioning exploit and scanning code rather than a README-only or fake project.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.