EIP-2026-109005

This exploit demonstrates a CSV injection vulnerability in Kimai 1.14, where a malicious payload in the timesheet description field is executed when exported to CSV and opened in Excel. The payload triggers command execution (e.g., opening a calculator) via Excel's formula injection.