CVE-2025-28254

Vulnerability

Description

A stored cross-site scripting (XSS) vulnerability exists in Leantime versions 3.2.1 and earlier. The flaw resides in the processMentions() function within the notification service, where the user's first name field is insufficiently sanitized before being included in email notifications. An authenticated attacker can inject arbitrary JavaScript or HTML into their own first name, which is then stored and later rendered in messages sent to other users via the notification system. [1][2]

Attack

Vector and Prerequisites

Exploitation requires a valid Leantime account with the ability to edit the user's profile, specifically the first name field. The attack is authenticated but no special administrative privileges are required; any standard user can modify their own first name. When the attacker triggers a mention (e.g., by using the @username syntax in a comment or task description), the processMentions() function processes the notification and includes the unsanitized first name. This malicious payload is then delivered to the intended recipient(s) through the application's in-app or email notification system. The attack is therefore server-side stored and executed in the context of the victim's session when they view the notification. [3][4]

Impact

A successful exploit allows an authenticated attacker to execute arbitrary HTML and JavaScript in the browser of any user who receives a notification containing the crafted mention. This can lead to session hijacking, data exfiltration, manipulation of the user interface, and theft of sensitive information accessible to the victim within the Leantime application. Since the payload is stored in the database and persists until the affected user updates their first name, the attack can affect multiple victims over time. [2][4]

Mitigation

Status

The vulnerability is present in Leantime versions 3.2.1 and earlier. Users should upgrade to a patched version as soon as it becomes available. The project maintainers have acknowledged the issue and a security advisory (GHSA-95j3-435g-vjcp) has been published. Until an official patch is applied, administrators can mitigate the risk by restricting profile editing privileges or by implementing a web application firewall (WAF) rule to block XSS payloads in the first name field, though these are not complete solutions. [1][4]