CVE-2026-66415

Deferred Deferred - Pending Action

Authenticated SSRF and LFI in Leantime via Unsanitized File Paths

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66415

EUVD

EUVD-2026-51245

Affected Vendors & Products

Vendor	Product	Version / Range
leantime	leantime	3.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Leantime 3.6.2 has a server-side request forgery and local file inclusion vulnerability. Authenticated attackers can read internal resources by passing unsanitized filenames to file_get_contents() in the Blueprints::import() method. The vulnerability allows crafted filenames with URL wrappers or path traversal sequences to access cloud metadata or read arbitrary server files via the JSON-RPC API endpoint.

Detection Guidance

To detect this vulnerability, inspect Leantime 3.6.2 instances for unusual file access patterns or requests to internal resources via the JSON-RPC API. Check server logs for file_get_contents() calls with unsanitized filenames or URL wrappers like php://filter or file://. Monitor for path traversal attempts in API requests.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server, including configuration files, source code, or other confidential data. If exploited, it could lead to unauthorized data exposure, system compromise, or further attacks within the network. The impact depends on the server's file permissions and the attacker's goals.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation could result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Leantime to a patched version beyond 3.6.2. If upgrading is not possible, restrict access to the JSON-RPC API endpoint and implement strict input validation for filenames. Disable URL wrappers in file_get_contents() and apply file path sanitization to block traversal sequences.

Hi! I’m here to help you understand CVE-2026-66415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70