---
id: CVE-2026-66415
title: >-
  Leantime Server-Side Request Forgery and Local File Inclusion in
  Blueprints::import()
summary: >-
  Leantime 3.6.2 contains a server-side request forgery and local file inclusion
  vulnerability that allows authenticated attackers to read internal resources
  by passing unsanitized user-supplied filenames to file_get_contents() in the
  Blue…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Leantime
product: Leantime
affected:
  - Leantime <= 3.6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-30T17:31:50.289166Z'
published: '2026-07-30'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:22.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-66415'
references:
  - url: 'https://github.com/Leantime/leantime/pull/3656'
    label: Pull Request
  - url: >-
      https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-gphg-6h4g-mg22
    label: GitHub Security Advisory (GHSA-gphg-6h4g-mg22)
  - url: 'https://github.com/Leantime/leantime'
    label: Product Repository
  - url: >-
      https://www.vulncheck.com/advisories/leantime-server-side-request-forgery-and-local-file-inclusion-in-blueprints-import
tags:
  - cve.org
epss: 0.0035
epssPercentile: 0.25964
ingestedAt: '2026-09-24T15:45:56.719Z'
---

## Overview

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.

## Affected

- `Leantime <= 3.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.