CVE-2026-66415: Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66415?
The severity of CVE-2026-66415 is rated high with a score of 8.5.
How do I fix CVE-2026-66415?
To fix CVE-2026-66415, ensure that user-supplied filenames are properly validated and sanitized before being passed to file_get_contents() in the Blueprints::import() method.
What vulnerabilities are associated with CVE-2026-66415?
CVE-2026-66415 is associated with server-side request forgery (SSRF) and local file inclusion vulnerabilities.
What versions of Leantime are affected by CVE-2026-66415?
CVE-2026-66415 affects Leantime version 3.6.2.
What can attackers do with CVE-2026-66415?
Attackers can exploit CVE-2026-66415 to read internal resources by leveraging unsanitized input in the Blueprints::import() method.