CVE-2026-66415 Leantime CVE debrief

Who should care

Users of Leantime 3.6.2, administrators of Leantime installations, and security teams monitoring for potential server-side request forgery and local file inclusion attacks should be aware of this vulnerability. They should review their deployments, verify affected scope, and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review. Operators and platform administrators should prioritize patching or mitigating this vulnerability to prevent potential data breaches or system compromise. Vulnerability management teams should assess the risk and implement controls to prevent exploitation. Asset inventory and change management processes should be reviewed to ensure that affected systems are identified and remediated promptly. Security teams should also consider implementing additional monitoring and detection controls to identify potential exploitation attempts. Finally, incident response teams should be prepared to respond to potential security incidents related to this vulnerability. Security teams should also consider reviewing their incident response plans to ensure they are prepared to respond to potential security incidents related to this vulnerability. Security teams should review their current security controls and ensure they are effective in preventing exploitation of this vulnerability. Security teams should also consider implementing additional security controls to prevent exploitation of this vulnerability. Security teams should review their current patch management processes to ensure that affected systems are patched or mitigated promptly. Security teams should also consider implementing additional security controls to prevent exploitation of this vulnerability. Security teams should review their current vulnerability management processes to ensure that affected systems

Technical summary

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. The vulnerability can be exploited through the JSON-RPC API endpoint, allowing attackers to access cloud metadata services or read arbitrary files from the server filesystem.

Defensive priority

Authenticated attackers can exploit this vulnerability to read internal resources, access cloud metadata services, or read arbitrary files from the server filesystem.

Recommended defensive actions

• Inventory and verify Leantime 3.6.2 installations
• Restrict access to the Blueprints::import() method
• Implement path validation for user-supplied filenames
• Monitor for suspicious file access attempts
• Apply vendor remediation when available

Evidence notes

The vulnerability exists in Leantime 3.6.2, allowing authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Evidence is limited to public sources and vendor statements. Defenders should verify affected deployments, review official advisories, and monitor for suspicious file access attempts.

Official resources