CVE-2026-94211 in Leantime
Summary
by MITRE • 09/21/2026
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in Hyve5 Leantime versions up to 3.9.8 represents a significant security flaw within the Project Dashboard component, specifically located in the file /app/Domain/Dashboard/Templates/show.blade.php. This issue is classified as an Unrestricted Upload of Wrongly-Referenced File or Cross-Site Scripting (XSS) depending on the specific vector, but the description clearly indicates a Stored Cross-Site Scripting vulnerability. The core technical flaw arises from the application's failure to properly sanitize user-supplied input before including it in web pages. Specifically, when an administrator with edit permissions modifies project details, they can inject malicious script payloads into fields that are subsequently rendered on the dashboard template without adequate encoding or validation. This lack of output encoding allows arbitrary JavaScript code to be executed within the context of other users' browsers who view the compromised project dashboard.
From a technical perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The severity is heightened because it is a stored XSS variant rather than a reflected one. In stored XSS, the malicious payload is permanently saved on the target server, such as in a database or file system, and is then retrieved and displayed to other users later. This means that every time an authenticated user accesses the affected project dashboard, their browser will execute the injected script automatically. The requirement for "EDIT perm" restricts the initial attack vector to authenticated insiders with specific privileges, but once planted, the impact extends cross-user, affecting any individual who views the poisoned label name or associated content on the dashboard.
The operational impact of this vulnerability is substantial due to its persistent nature and broad reach within an organization's workflow. Attackers can exploit this flaw to steal session cookies, hijack user sessions, perform actions on behalf of victims, deface websites, or redirect users to malicious sites. Since Leantime is often used for project management involving sensitive business data, the compromise of user accounts could lead to further lateral movement within an organization's network if credentials are reused across systems. The fact that the exploit has been disclosed publicly and may be actively used increases the urgency for remediation. Organizations relying on this version face a high risk of unauthorized access and data exfiltration without any immediate technical controls in place by the vendor.
This incident also highlights critical gaps in the software supply chain security and vulnerability management processes. The vendor, Hyve5, was contacted early regarding this disclosure but failed to respond or provide patches for an extended period. This lack of communication leaves users exposed during a critical window where public knowledge of the exploit exists without corresponding fixes. From a threat intelligence perspective, this behavior mirrors patterns seen in ATT&CK technique T1059: Command and Scripting Interpreter, specifically when used for persistent access via stored scripts. It also relates to MITRE CWE-642: External Control of Critical State Data, as the application state is manipulated by unauthorized or malicious inputs that are not validated against expected formats.
Mitigation strategies must be implemented immediately given the absence of a vendor patch. Administrators should restrict edit permissions for project dashboards and labels to only those users who absolutely require such access, thereby reducing the attack surface. Input validation and output encoding must be enforced at both the application logic level and the template rendering engine level. Developers need to ensure that all dynamic content rendered in Blade templates is passed through appropriate escaping functions provided by Laravel or custom sanitization routines that neutralize HTML special characters. Additionally, implementing a Content Security Policy (CSP) can help mitigate the impact of any successfully injected scripts by restricting the sources from which scripts are allowed to execute. Organizations should also consider upgrading to newer versions if available and monitoring vendor communications for future updates, while simultaneously auditing existing deployments for signs of compromise such as unexpected script tags in project data fields.