Summary The "SearchHelper" class in Kimai interpolates user-controlled meta-field names from search terms directly into DQL (Doctrine Query Language) queries without sanitization. When a search term is formatted as "FIELDNAME:VALUE", the "FIELDNAME" portion is parsed by "SearchTermPart" and used as-is to construct DQL subquery aliases via string concatenation in "sprintf()". ### Details Affected file: "src/Repository/Search/SearchHelper.php" The vulnerable code constructs a DQL subquery using unsanitized user input: "$metaName" is obtained from "SearchTermPart::getField()" which returns raw user input (everything before the ":" in a search term, split by spaces). No validation ensures the value is a valid DQL identifier. ### PoC A PoC was provided, but removed for security reasons. ### Impact 1. Denial of Service — Any authenticated user can cause errors (log entires) in all search API endpoints by injecting special characters (".", ",", "(", ")", "'", "-", etc.) into meta-field search terms 2. DQL manipulation — User-controlled input is interpolated directly into DQL query strings without parameterization 3. Error-based information disclosure — In development mode, error responses may leak DQL structure, entity class names, and database schema details ## Solution - The DQL identifier is now generated, no user input will be used See "https://www.kimai.org/en/security/ghsa-9cxw-hp3c-637x" (https://www.kimai.org/en/security/ghsa-9cxw-hp3c-637x) for more information.