{"id":"CVE-2026-66415","title":"Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()","summary":"Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blue…","severity":"high","cvss":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"Leantime","product":"Leantime","affected":["Leantime <= 3.6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-30T17:31:50.289166Z"},"published":"2026-07-30","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:18:22.846Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-66415","references":[{"url":"https://github.com/Leantime/leantime/pull/3656","label":"Pull Request"},{"url":"https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-gphg-6h4g-mg22","label":"GitHub Security Advisory (GHSA-gphg-6h4g-mg22)"},{"url":"https://github.com/Leantime/leantime","label":"Product Repository"},{"url":"https://www.vulncheck.com/advisories/leantime-server-side-request-forgery-and-local-file-inclusion-in-blueprints-import"}],"tags":["cve.org"],"epss":0.0035,"epssPercentile":0.25871,"ingestedAt":"2026-09-24T15:45:56.719Z","slug":"CVE-2026-66415","body":"## Overview\n\nLeantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.\n\n## Affected\n\n- `Leantime <= 3.6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}