GHSA-qrfh-cc86-vc8c Leantime has HTML injection through firstname and lastname fields
Authenticated users can inject HTML into user profiles, leading to stored XSS attacks against other users viewing the content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-qrfh-cc86-vc8c?
GHSA-qrfh-cc86-vc8c is a cross-site scripting vulnerability in leantime/leantime, published on 5 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Summary
Leantime v2.3.27 is vulnerable to Stored HTML Injection. The firstname and lastname fields in the admin user edit page are rendered without HTML escaping, allowing an authenticated user to inject arbitrary HTML that executes when the profile is viewed.
Vulnerable File
app/Domain/Users/Templates/editUser.tpl.php
Vulnerable Code (Lines ~14-17)
value="<?php echo $values['firstname'] ?>"
value="<?php echo $values['lastname'] ?>"
These fields output raw user input without sanitization.
Steps to Reproduce
- Login as admin > Go to Settings > Users > Edit any user
- Enter HTML payload in First Name or Last Name field:
<h1>INJECTED</h1> - Save the user profile
- Create or view an article — the injected HTML renders in the author name
Fix
Replace unescaped echo with htmlspecialchars():
value="<?php echo htmlspecialchars($values['firstname'], ENT_QUOTES, 'UTF-8') ?>"
value="<?php echo htmlspecialchars($values['lastname'], ENT_QUOTES, 'UTF-8') ?>"
Or use the existing $this->e() helper already used in editOwn.tpl.php.
Impact
- Stored HTML injection visible to all users viewing affected content
- Can be used for phishing, fake login forms, and UI defacement
- Affects all versions before 3.3.0
Which versions are affected by GHSA-qrfh-cc86-vc8c?
2 open source packages ship an affected version, including leantime/leantime.
| Package | Affected | Fixed in |
|---|---|---|
leantime/leantime Packagist | All versions | 3.3.0 |
leantime/leantime Packagist | All versions | 3.3.0 |
How do I fix GHSA-qrfh-cc86-vc8c?
Upgrade leantime/leantime to 3.3.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-qrfh-cc86-vc8c being exploited?
There is no known exploitation of GHSA-qrfh-cc86-vc8c in the wild and no public exploit code.