CVE-2025-28254
Leantime affected by Improper Neutralization of HTML Tags
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
CVE-2025-28254- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-8662
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
EUVD-2025-8662- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-95j3-435g-vjcp
Leantime affected by Improper Neutralization of HTML Tags
Summary
HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.
- Record
GHSA-95j3-435g-vjcp- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jf6p-4hgv-v6qh
Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references.
Original Description
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
GHSA-jf6p-4hgv-v6qh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
NVD
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
CVE-2025-28254- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
CVE-2025-28254- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-95j3-435g-vjcp
Leantime affected by Improper Neutralization of HTML Tags
Summary
HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.
- Record
GHSA-95j3-435g-vjcp- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-jf6p-4hgv-v6qh
Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references.
Original Description
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
- Record
GHSA-jf6p-4hgv-v6qh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
leantime/leantimePackagist |
before 3.3 | 3.3 |
leantime/leantimePackagist |
before 3.3, plus listed versions 2.42.4-beta2.4-beta-72.4-beta-82.4.1 Show 45 moreShow less2.4.22.4.32.4.42.4.52.4.72.4.83.0.03.0.0-beta3.0.13.0.23.0.33.0.43.0.53.0.63.0.73.1.0-beta3.1.13.1.23.1.33.1.43.2.03.2.0-beta3.2.0-beta-23.2.1v2.0v2.0.1v2.0.10v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1v2.1-betav2.1-beta2v2.1-beta3v2.1-beta5 |
3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-28254 is a medium vulnerability (CVSS 5.4) in Leantime, published February 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in leantime/leantime 3.3.
References
github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php
nvd.nist.gov/vuln/detail/CVE-2025-28254
Left out here: 50 versions. The JSON record has them.