5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qrfh-cc86-vc8c

GHSA-qrfh-cc86-vc8c: Leantime has HTML injection through firstname and lastname fields

Summary

Leantime v2.3.27 is vulnerable to Stored HTML Injection. The firstname and lastname fields in the admin user edit page are rendered without HTML escaping, allowing an authenticated user to inject arbitrary HTML that executes when the profile is viewed.

Vulnerable File

app/Domain/Users/Templates/editUser.tpl.php

Vulnerable Code (Lines ~14-17)

value="<?php echo $values['firstname'] ?>"
value="<?php echo $values['lastname'] ?>"

These fields output raw user input without sanitization.

Steps to Reproduce

Login as admin > Go to Settings > Users > Edit any user
Enter HTML payload in First Name or Last Name field: <h1>INJECTED</h1>
Save the user profile
Create or view an article — the injected HTML renders in the author name

Fix

Replace unescaped echo with htmlspecialchars():

value="<?php echo htmlspecialchars($values['firstname'], ENT_QUOTES, 'UTF-8') ?>"
value="<?php echo htmlspecialchars($values['lastname'], ENT_QUOTES, 'UTF-8') ?>"

Or use the existing $this->e() helper already used in editOwn.tpl.php.

Impact

Stored HTML injection visible to all users viewing affected content
Can be used for phishing, fake login forms, and UI defacement
Affects all versions before 3.3.0

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qrfh-cc86-vc8c

GHSA-qrfh-cc86-vc8c:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
leantime/leantime	composer	< 3.3.0	3.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored HTML injection within the Leantime application, specifically in the user profile editing functionality. The analysis of the provided patch in commit 3f8b2c6346111694bb18cec558b27c22d3a2b9d1 clearly indicates that multiple input fields (firstname, lastname, user, phone, jobTitle, jobLevel, department) were being rendered without proper output escaping. The vulnerable code, located in the app/Domain/Users/Templates/editUser.tpl.php template file, used <?php echo $values[...] ?> to directly output raw data into the value attribute of HTML <input> tags. This allows an authenticated user with privileges to edit user profiles to inject arbitrary HTML, which is then stored in the database and executed when other users view the profile. The fix replaces the direct echo with a call to $tpl->escape(), which presumably sanitizes the output. Since the vulnerability lies within a template file rather than a defined function, the vulnerable component is identified by the file path itself, as this is the unit of code that a runtime profiler would identify as being executed during the rendering process.

Vulnerable functions

app/Domain/Users/Templates/editUser.tpl.php

app/Domain/Users/Templates/editUser.tpl.php

The template file `app/Domain/Users/Templates/editUser.tpl.php` directly renders user-provided data to HTML without proper escaping. The `echo` statements for `firstname`, `lastname`, `user`, `phone`, `jobTitle`, `jobLevel`, and `department` allow for stored HTML injection. The vulnerability is not in a specific class method but in the rendering logic of the template itself. An attacker can inject malicious HTML into these fields, which will be executed in the victim's browser when viewing the user's profile.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-qrfh-cc86-vc8c: Leantime has HTML injection through firstname and lastname fields

Summary

Vulnerable File

Vulnerable Code (Lines ~14-17)

Steps to Reproduce

Fix

Impact

GHSA-qrfh-cc86-vc8c:

5.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-qrfh-cc86-vc8c: Leantime has HTML injection through firstname and lastname fields

Summary

Vulnerable File

Vulnerable Code (Lines ~14-17)

Steps to Reproduce

Fix

Impact

5.4

5.4

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI