GHSA-qrfh-cc86-vc8c Leantime has HTML injection through firstname and lastname fields

• Packagist leantime/leantime: < 3.3.0 → fixed in 3.3.0

Summary Leantime v2.3.27 is vulnerable to Stored HTML Injection. The `firstname` and `lastname` fields in the admin user edit page are rendered without HTML escaping, allowing an authenticated user to inject arbitrary HTML that executes when the profile is viewed. Vulnerable File `app/Domain/Users/Templates/editUser.tpl.php` Vulnerable Code (Lines ~14-17) ```php value="" value="" ``` These fields output raw user input without sanitization. Steps to Reproduce 1. Login as admin > Go to Settings > Users > Edit any user 2. Enter HTML payload in First Name or Last Name field: `INJECTED` 3. Save the user profile 4. Create or view an article — the injected HTML renders in the author name Fix Replace unescaped `echo` with `htmlspecialchars()`: ```php value="" value="" ``` Or use the existing `$this->e()` helper already used in `editOwn.tpl.php`. Impact • Stored HTML injection visible to all users viewing affected content • Can be used for phishing, fake login forms, and UI defacement • Affects all versions before 3.3.0