GHSA-95j3-435g-vjcp

Leantime affected by Improper Neutralization of HTML Tags

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-28254

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	leantime/leantime	< 3.3	3.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.

References

External links from the advisory. They lead to third-party sites.

https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp web
https://nvd.nist.gov/vuln/detail/CVE-2025-28254 advisory
https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 web
https://github.com/Leantime/leantime package
https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 web