Leantime affected by Improper Neutralization of HTML Tags

MEDIUM 5.4CVE-2025-28254 · GHSA-95j3-435g-vjcp · Published 28/03/2025 · updated 17/06/2026

In short

CVE-2025-28254 is a MEDIUM (CVSS 5.4) vulnerability affecting leantime/leantime, leantime (leantime).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 27.0% of all vulnerabilities.
Fix: update to 3.3, 3.3.0 or later.

Package	Affected versions	Patched versions
leantime/leantime Packagist	`< 3.3`	`3.3`
leantime leantime	`< 3.3.0`	`3.3.0`

Description

Summary

HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.

NVD description

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

References

Leantime/leantime security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-28254 · ADVISORY
Leantime/leantime commit ce1d207 · WEB
Leantime/leantime · PACKAGE
Leantime/leantime · WEB

More vulnerabilities in leantime/leantime

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

leantime/leantime

Packagist

< 3.3

3.3

leantime

< 3.3.0

3.3.0

Description

Summary

NVD description

More vulnerabilities in leantime/leantime

See all →