GHSA-mg4c-884j-pcq9
Leantime allows Stored Cross-Site Scripting (XSS)
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Leantime allows Stored Cross-Site Scripting (XSS)
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3
- Record
GHSA-mg4c-884j-pcq9- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Leantime allows Stored Cross-Site Scripting (XSS)
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3
- Record
GHSA-mg4c-884j-pcq9- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
leantime/leantimePackagist | before 3.3 | 3.3 |
leantime/leantimePackagist | before 3.3, plus listed versions 2.42.4-beta2.4-beta-72.4-beta-82.4.1 Show 45 moreShow less2.4.22.4.32.4.42.4.52.4.72.4.83.0.03.0.0-beta3.0.13.0.23.0.33.0.43.0.53.0.63.0.73.1.0-beta3.1.13.1.23.1.33.1.43.2.03.2.0-beta3.2.0-beta-23.2.1v2.0v2.0.1v2.0.10v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1v2.1-betav2.1-beta2v2.1-beta3v2.1-beta5 | 3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mg4c-884j-pcq9 is a medium vulnerability (CVSS 5.1) in leantime/leantime, published February 21, 2025. No source lists public exploit code. Fixed in leantime/leantime 3.3.
References
Left out here: 50 versions. The JSON record has them.