Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-66415Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

High 8.5

In plain English

A high-severity server-side request forgery in Leantime from Leantime. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.

Affected products (as reported)

Vendor	Product	Versions
Leantime	Leantime	0 – through 3.6.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

Pull Request issue-tracking, patch
GitHub Security Advisory (GHSA-gphg-6h4g-mg22) vendor-advisory
Product Repository product
https://www.vulncheck.com/advisories/leantime-server-side-request-forgery-and-local-file-inclusion-in-blueprints-import third-party-advisory