CVE-2026-66415 in Leantime
Summary
by MITRE • 07/30/2026
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within Leantime version 3.6.2 and represents a critical security flaw that combines server-side request forgery with local file inclusion capabilities. The issue stems from insufficient input validation in the Blueprints::import() method where user-supplied filenames are directly passed to the file_get_contents() function without proper sanitization or path validation. This design flaw allows authenticated attackers to manipulate the application's file handling mechanisms by submitting maliciously crafted filenames through the JSON-RPC API endpoint.
The technical implementation of this vulnerability leverages path traversal sequences and URL wrappers that enable attackers to bypass normal filesystem access controls. When an attacker submits a filename containing sequences such as ../ or // or utilizes PHP URL wrappers like phar:// or http://, the application processes these inputs without proper validation, allowing unauthorized access to internal system resources. This includes the ability to read sensitive files from the server filesystem and potentially access cloud metadata services that are typically restricted to authorized internal components.
From an operational impact perspective, this vulnerability creates significant risk for organizations using Leantime 3.6.2 as it provides authenticated attackers with the capability to extract sensitive information from the application's underlying system. The attack surface includes not only local files but also potentially cloud metadata services that could reveal credentials, configuration data, or other sensitive information. This vulnerability directly maps to CWE-98 and CWE-20, representing local file inclusion and improper input validation respectively, both of which are classified as high-risk security flaws in the CWE database.
The exploitation of this vulnerability requires an authenticated user context, which reduces the attack surface compared to unauthenticated exploits but still represents a serious concern for organizations where privilege escalation or credential compromise has occurred. Attackers can leverage this vulnerability to gain insights into the application's internal structure, potentially leading to further exploitation opportunities or information disclosure that could facilitate more sophisticated attacks. The use of JSON-RPC API endpoint as the attack vector indicates that this vulnerability affects not only web-based interactions but also programmatic access to the application's functionality.
Organizations should implement immediate mitigations including input validation and sanitization of all user-supplied filenames, implementing proper path validation mechanisms to prevent traversal sequences, and restricting file operations to predefined safe directories. The implementation of a whitelist approach for allowed file types and paths would significantly reduce the attack surface. Additionally, organizations should consider implementing network-level protections such as firewalls that restrict access to internal metadata services and ensure that authentication controls are properly enforced at all API endpoints. This vulnerability aligns with ATT&CK technique T1566 which covers credential harvesting through social engineering or exploitation of application vulnerabilities, and T1083 which involves discovering files and directories on the target system. Regular security assessments and input validation reviews should be conducted to prevent similar issues in future development cycles.