GitHub Advisoryadvisory · Packagist

GHSA-95j3-435g-vjcp Leantime affected by Improper Neutralization of HTML Tags

MEDIUM Published 2025-02-21 Modified 2025-03-31 Official page ↗
Aliases
CVE-2025-28254
Ecosystem
Packagist
Packages
leantime/leantime
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.3 → fixed in 3.3

Description

Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.

Related

Alias · CVE (1)

  • CVE-2025-28254 Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain… vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References