Description

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-21T13:17:11.953Z",
  "pubdate": "2026-09-21T13:17:11.953Z",
  "executiveSummary": "A critical stored Cross-Site Scripting (XSS) vulnerability has been identified in Hyve5 Leantime, affecting all versions up to and including 3.9.8. The security flaw is located within the Project Dashboard component, specifically targeting the template file /app/Domain/Dashboard/Templates/show.blade.php. An attacker with sufficient privileges, specifically holding the 'EDIT perm' permission, can exploit this vulnerability by injecting a malicious script payload into a project label name. Because the application fails to sanitize or sanitize-encode this input, the poisoned label is stored directly in the database.\nWhen other users, including administrators, view the compromised Project Dashboard, the application echoes the payload raw, causing the script to execute within the context of their active sessions. This leads to a cross-user execution scenario where sensitive session tokens can be exfiltrated, unauthorized administrative actions can be performed, and the integrity of the application can be compromised. The vulnerability can be exploited remotely, and because public exploit details have been disclosed without a vendor response or official patch, the risk of active exploitation is significant for organizations running affected instances of Leantime.",
  "technicalDetails": "The vulnerability stems from a lack of input sanitization and context-aware output encoding within the template engine of Hyve5 Leantime. Specifically, the file /app/Domain/Dashboard/Templates/show.blade.php, which handles the presentation layer of the Project Dashboard component, renders dynamic variables containing label names directly to the Document Object Model (DOM) without sanitization. In Laravel's Blade templating engine, rendering data raw (often done via the unescaped '{!! $variable !!}' syntax) bypasses default security controls, allowing raw HTML and JavaScript to be parsed by the client's browser.\nThe attack flow begins with an authenticated attacker who possesses 'EDIT perm' privileges within a target project. Using these privileges, the attacker interacts with the application interface to modify or create a project label. Instead of providing a benign name, the attacker inputs a crafted JavaScript payload, such as an inline script tag or an event handler attribute. Because the application does not validate or sanitize this input upon receipt, the malicious string is written directly to the underlying database.\nThe secondary phase of the attack occurs when any victim—regardless of their privilege level—navigates to the Project Dashboard of the affected project. The backend application queries the database, retrieves the records, and forwards the unsanitized label name to the show.blade.php template for rendering. As the page loads in the victim's browser, the raw output is interpreted as executable code.\nThe injected script executes within the victim's browser session under the origin of the Leantime application. This grants the attacker the ability to perform actions on behalf of the victim, such as modifying project settings, creating administrative accounts, or reading sensitive project data. Furthermore, if the victim is an administrator, the attacker can leverage this access to compromise the entire application instance. The impact is magnified because the execution occurs silently without the victim's knowledge, and the persistence of the payload in the database ensures that every subsequent visit to the dashboard by any user triggers the exploit.\nDue to the remote nature of the exploit and the fact that public proof-of-concept information is available, threat actors can easily adapt public exploits to target vulnerable installations. Because the vendor did not respond to early disclosure efforts, there is no official upstream patch, meaning that the vulnerability remains zero-day in nature for unpatched deployments, necessitating immediate manual remediation at the template level."
}