leantime vulnerabilities and fixes

Recent CVEs affecting leantime, with upgrade or downgrade steps. 4 tracked.

leantime has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-03-28. Highest priority: CVE-2024-27474 (score 49/100).

• CVE-2025-28254 MEDIUM 5.4 UPGRADE Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute a
• CVE-2024-27477 MEDIUM 6.1 DOWNGRADE In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification fun
• CVE-2024-27476 MEDIUM 4.7 DOWNGRADE Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
• CVE-2024-27474 HIGH 8.8 DOWNGRADE Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

FAQ

How do I fix leantime vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is leantime being exploited right now?

None of the tracked leantime CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which leantime CVE should I patch first?

CVE-2024-27474 currently ranks highest (49/100): Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF).

RSS feed for leantime · ← Back to latest CVEs