Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
Date: 2026-05
Affected: composer/kimai/kimai
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-693

### Summary Kimai's Twig sandbox (`StrictPolicy`, used for admin-uploaded invoice and export templates) allow-lists the `config()` Twig function with no key filtering. `config(name)` delegates to `App\Configuration\SystemConfiguration::find($name)`, which returns arbitrary entries from the flattened `kimai.config` container parameter built in `App\DependencyInjection\AppExtension::loadInternal()`. Any admin who can upload a Twig template can therefore render server-wide secrets - the LDAP bind password, the SAML SP private key, and any other dotted configuration key populated from `kimai.yaml` - into the invoice or export output, which is then delivered to whoever generates an invoice or export from that template (including lower-privileged users such as teamleads with invoice permissions). This is a second, uncovered class of the same defense-in-depth issue patched in GHSA-rh42-6rj2-xwmc: the previous fix added a User-method blocklist but left the `config()` function unrestricted. ### Details `src/Twig/SecurityPolicy/StrictPolicy.php:40-55` explicitly allow-lists `'config'`: ```php private array $allowedFunctions = [ 'max', 'min', 'range', 'constant', 'cycle', 'random', 'date', 't', 'encore_entry_css_source', 'encore_entry_link_tags', 'encore_entry_script_tags', 'is_granted', 'qr_code_data_uri', 'config', // <-- sink, no key filter 'create_date', 'month_names', 'locale_format', 'class_name' ]; ``` `src/Twig/Configura


Mitigations:

Architectural layers (MAESTRO):