CVE-2025-28254: XSS
Summary
HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.
Other sources
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-28254?
CVE-2025-28254 is classified as a critical vulnerability due to its potential for arbitrary code execution and data exposure.
Who is affected by CVE-2025-28254?
CVE-2025-28254 affects authenticated users of Leantime versions 3.2.1 and earlier.
How do I fix CVE-2025-28254?
To fix CVE-2025-28254, upgrade to Leantime version 3.2.2 or later.
What kind of attack can be executed using CVE-2025-28254?
CVE-2025-28254 allows an authenticated attacker to execute Cross Site Scripting (XSS) attacks through the first name field.
What information can be compromised due to CVE-2025-28254?
An attacker exploiting CVE-2025-28254 can potentially obtain sensitive information from authenticated user sessions.