CVE-2026-66415

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2

Description An authenticated attacker can perform server-side request forgery (SSRF) and local file inclusion (LFI) by providing unsanitized filenames to the file get contents() function within the Blueprints::import() method. This occurs due to a lack of path validation. By sending crafted filenames containing path traversal sequences or URL wrappers through the JSON-RPC API endpoint, an attacker can read arbitrary files from the server filesystem or access cloud metadata services.

Recommendations Update Leantime to a version newer than 3.6.2. As a temporary mitigation, restrict access to the JSON-RPC API endpoint to minimize the risk of exploitation.