CVE-2026-94211: Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who can be affected by the payload?
An attacker needs EDIT permission to plant the malicious label name. Once planted, the script can execute for any user who views the affected project dashboard.
Can this be exploited remotely?
Yes. The attack may be performed remotely, but it requires an authenticated user with EDIT permission and user interaction from someone viewing the poisoned project dashboard.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What versions are identified as affected?
Hyve5 Leantime versions up to and including 3.9.8 are identified as affected.