CVE-2026-66415

High

Description

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.

SeverityHigh

CVSS8.5

Exploit probability—

ProductLeantime

PublishedJul 30, 2026

First seenJul 30, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/Leantime/leantime/pull/3656

Vendor advisories

github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-gphg-6h4g-mg22

Affected products

Product	Affected versions	Fixed in
Leantime Leantime	v ≤ 3.6.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.