Description

The folder name does not sanitize folder name and due to missing output encoding, HTML user-input is rendered in the webpage during folder deletion.

Proof of Concept

1. Login to Teampass as any user.
2. Go to Folders tab.
3. Create a new folder with HTML tag in the Label. Example: <h1>HTML Injection<h1>
4. Select the created folder and click on Delete.
5. The HTML code from the Label is rendered in the webpage.

Impact

An user with authorization to create folders can add HTML code to the Label and add items to the page during folder deletion by other users. This could be used to deceive and phish unsuspecting users.