CVE-2026-94211

Executive Summary

CVE-2026-94211 is a stored (persistent) cross-site scripting vulnerability in Hyve5 Leantime, an open-source project management platform, affecting versions up to and including 3.9.8. The flaw resides in the Project Dashboard rendering component, where a poisoned label value is echoed without output encoding, allowing an attacker holding "EDIT perm" to inject script that executes in the browser session of any user who views the affected project dashboard. With a CVSS base score of 2.4, the direct confidentiality impact is limited, but the cross-user execution model and the persistent nature of the payload raise the risk of session hijacking and privilege abuse in collaborative environments.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the persistent/stored sub-type. According to the NVD description, the affected functionality is located in the file /app/Domain/Dashboard/Templates/show.blade.php, which belongs to the Project Dashboard component. Leantime is built on the Laravel framework and uses the Blade templating engine; the .blade.php extension indicates server-side template rendering that ultimately produces HTML delivered to the browser.

The disclosed mechanism is a classic stored XSS: a value described as a "label name" is persisted and later echoed "raw" — meaning output is emitted without HTML entity encoding — into the dashboard page. In Blade terminology, raw output corresponds to unescaped interpolation; the description's phrasing "echoed raw" is consistent with an unescaped rendering directive being used for attacker-controllable data. Because the poisoned label is rendered on the shared project dashboard, the script executes in the context of every user who loads that view, not only the attacker — hence the "fires cross-user" characterization.

Two preconditions define the attack surface. First, the attacker requires "EDIT perm" — the privilege to edit the relevant label. This aligns with the CVSS vector's PR:H (High privileges required), indicating the attacker must already possess an authenticated, elevated role within the instance. Second, a victim must view the poisoned project dashboard, reflected in UI:R (User Interaction Required). The network attack vector (AV:N) and low attack complexity (AC:L) mean no special conditions beyond authentication and victim interaction are needed to deliver the payload.

No specific function names, parameter names, or API endpoints beyond the referenced template file are provided in the disclosure, and none should be inferred. The sparseness of the advisory means the precise input field and storage path remain undocumented publicly; the vulnerability class and attack mechanism are, however, unambiguous.

Exploitation Scenarios

No public proof-of-concept code, Nuclei template, or exploit module has been confirmed. The following chain is inferred from the vulnerability class (stored XSS) and the facts stated in the disclosure.

1. Reconnaissance and target identification. An attacker identifies a reachable Leantime instance running version 3.9.8 or earlier, typically by fingerprinting the Leantime application login or dashboard pages. Instances exposed to the internet or shared across internal organizational networks represent candidate targets.

2. Precondition — authenticated editing access. The attacker must hold an account with "EDIT perm" on the target project. This could be a legitimate low-to-mid-level team member, a contractor, or an account compromised through credential reuse or phishing. With editing rights, the attacker locates the label-editing functionality associated with the project dashboard.

3. Payload injection. The attacker stores a crafted label name containing HTML/JavaScript. Because the value is persisted and later emitted without encoding in the Project Dashboard template, the payload survives storage and is served on every subsequent dashboard render.

4. Cross-user execution. Any user — including project managers or administrators with broader privileges — who opens the affected project dashboard receives the poisoned markup. The embedded script executes in that victim's authenticated browser context, at the origin of the Leantime instance.

5. Post-exploitation impact. A successful script executes with the victim's session privileges. At the vulnerability-class level, this enables session/token theft, performing authenticated actions as the victim, credential harvesting via injected forms, or redirecting the victim to attacker-controlled infrastructure. The CVSS impact subscores are low (C:N/I:L/A:N), reflecting limited direct confidentiality and integrity effect as assessed; however, in a collaborative platform where victims may hold higher roles than the attacker, privilege escalation through session abuse is a realistic escalation path.

Impact Assessment

The vulnerable system is any Hyve5 Leantime deployment at version 3.9.8 or below with the Project Dashboard component in use. The blast radius of a single injected label is bounded by the set of users who view the affected project dashboard — potentially an entire project team, including users with permissions exceeding those of the attacker.

CVSS 3.1 base score 2.4 reflects the specific subscore profile: network attack vector (AV:N) and low complexity (AC:L) reduce required effort, but this is offset by high privileges required (PR:H), user interaction required (UI:R), unchanged scope (S:U), and a low integrity-only impact (I:L), with no confidentiality or availability impact (C:N/A:N). The score should not be read as "negligible risk." A 2.4 score in a stored XSS context masks a meaningful cross-user threat: the stored payload is persistent, requires no per-victim interaction beyond loading a page the victim would normally visit, and executes with the victim's privileges. In environments where Leantime acts as a central coordination tool, the practical effect can be broader than the numeric score suggests.

Business impact includes potential unauthorized access to project data and communications, tampering with project content, and credential compromise of higher-privileged users. Because the flaw is unpatched and the vendor is unresponsive, exposed instances carry ongoing risk for the foreseeable future.

Detection Guidance

Sigma Rule

title: Leantime Project Dashboard Stored XSS Label Injection
id: 7c3a1f42-9b2e-4d51-a6c8-0e5f1d2b9a77
status: experimental
description: Detects HTTP requests to the Leantime project dashboard containing HTML/script markup in label-related parameters, consistent with CVE-2026-94211 stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94211
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/dashboard'
      - '/projects'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '<svg'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate rich-text content containing markup in label fields
level: medium
tags:
  - attack.t1189
  - cve.2026.94211
  - cwe.79

YARA Rule

rule CVE_2026_94211_Leantime_Stored_XSS
{
    meta:
        description = "Detects script/HTML injection markers consistent with stored XSS in Leantime Project Dashboard (CVE-2026-94211)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94211"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "<script" nocase
        $b = "onerror=" nocase
        $c = "onload=" nocase
        $d = "javascript:" nocase
        $e = "document.cookie" nocase
        $f = "show.blade.php" nocase
        $g = "Leantime" nocase

    condition:
        (1 of ($a,$b,$c,$d) and 1 of ($e)) or
        (2 of ($a,$b,$c,$d,$e) and $g) or
        ($f and 1 of ($a,$b,$c,$d))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-94211 Leantime Project Dashboard Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"dashboard"; nocase; http.client_body; content:"<script"; nocase; http.client_body; content:"onerror="; nocase; http.client_body; content:"onload="; nocase; classtype:web-application-attack; reference:cve,2026-94211; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94211; sid:202694211; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST" and
   url.path : "*dashboard*"]
  [network where network.protocol == "http" and http.request.method == "POST" and
   http.request.body.content : ("*<script*" or "*onerror=*" or "*onload=*" or "*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, cs_uri_stem), body=coalesce(body, cs_uri_query)
| where match(uri, "(?i)dashboard") AND (match(body, "(?i)<script") OR match(body, "(?i)onerror=") OR match(body, "(?i)onload=") OR match(body, "(?i)javascript:"))
| stats count min(_time) as first_seen max(_time) as last_seen values(body) as payload by src_ip, uri, useragent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,leantime,xss,">
  <rule id="100421" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">(?i)dashboard</field>
    <description>CVE-2026-94211 - Possible Leantime Project Dashboard stored XSS payload in request</description>
    <regex type="pcre2">(?i)(&lt;script|onerror=|onload=|javascript:)</regex>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_94211,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted about this disclosure but did not respond; no fixed version is available.

1. Immediate mitigations

• Restrict if possible: limit who holds "EDIT perm" on projects and audit current role assignments. The exploit requires edit rights, so tightening this permission shrinks the attack surface.
• Enforce strict output encoding at the rendering layer for label names and any attacker-controllable strings. The root cause is raw output of user-controlled data; escaping output on the Project Dashboard template removes exploitability without a vendor patch.
• Deploy a web application firewall (WAF) with XSS filtering and validate that rules catch script and event-handler injection in label fields. As with any WAF, this is defense-in-depth, not a fix.
• Isolate the instance from untrusted networks and require authentication for all dashboard access; avoid exposing Leantime directly to the internet if possible.
• Monitor for anomalous label content and unexpected script execution. Treat any stored markup in label fields as suspicious.

2. Patch/upgrade steps

• No official patch exists. Track the Leantime project for an advisory or fixed release beyond 3.9.8 and apply it as soon as it is published. Because the vendor is unresponsive, verify any community forks or upstream commits independently before relying on them.
• Until a patch ships, apply a local code fix if the deployment owns its source: locate unescaped output of label names in /app/Domain/Dashboard/Templates/show.blade.php and replace raw echoing with properly escaped output (e.g., Blade's escaped interpolation {{ }} instead of unescaped directives).

3. Long-term hardening

• Adopt a Content Security Policy (CSP) that disallows inline scripts and restricts script sources; this substantially reduces stored XSS impact even if individual output-escaping gaps recur.
• Establish a regular patching cadence for third-party/open-source project management tools and maintain an SBOM so vulnerable components are traceable.
• Enforce least privilege for project roles and audit who holds edit rights; perform periodic reviews of stored content fields that flow into templates.
• Integrate SAST into CI/CD pipelines to catch unescaped output in template files during development, and encourage vendor communication for coordinated disclosure.

References

1. National Vulnerability Database — CVE-2026-94211: https://nvd.nist.gov/vuln/detail/CVE-2026-94211
2. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
3. Hyve5 Leantime project (upstream source and release tracking, vendor advisory unavailable at time of writing): https://github.com/Leantime/leantime
4. FIRST EPSS — not yet scored for this CVE at time of writing (no value available).
5. CISA Known Exploited Vulnerabilities catalog — CVE-2026-94211 is not listed as of this report; no known in-the-wild exploitation or named threat actor campaigns are associated with this CVE in available data.