[MEDIUM] Kimai has an Authenticated Server-Side Template Injection (SSTI)

PKSA-pn9p-tcw8-rbpj CVE-2026-23626 GHSA-jg2j-2w24-54cg

Affected package: kimai/kimai

Affected version: <2.46.0

Reported by:
GitHub