Leantime CVE-2026-66415

Exploitation requires an authenticated Leantime account (CVSS PR:L) that holds CREATE authorization on a target project, and a reachable JSON-RPC API endpoint that exposes the Blueprints import operation; the attacker supplies a crafted filename containing a PHP URL wrapper (http://, ftp://, file://, php://) or ../ traversal sequence to Blueprints::import(). The vulnerability is limited to Leantime 3.6.2 (and unfixed earlier builds) before PR #3656; it does not require user interaction (UI:N) but is gated by the authentication/authorization requirement, meaning it is not exploitable by anonymous internet users. Real-world SSRF value further depends on the deployment environment - the cloud-metadata pivot only pays off when Leantime runs on a cloud instance with an exposed metadata service.

The CVSS 4.0 base score is 8.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/SC:H, meaning network-reachable, low-complexity, low-privilege exploitation with high confidentiality impact on both the vulnerable system and a subsequent system (the SSRF target) - the SC:H is what elevates this beyond a plain file read. PR:L is the key limiter: the attacker must be an authenticated Leantime user, and the fix's authorization test (test_import_authorizes_create_on_target_project) indicates CREATE rights on a target project are required, so this is not an unauthenticated internet-wide bug. Public PoC exists (GHSA-gphg-6h4g-mg22 and the VulnCheck advisory), which raises practical risk, but no EPSS score and no CISA KEV entry were provided, so there is no evidence of mass or automated exploitation - treat this as a credible, prioritize-if-exposed issue rather than an emergency internet-worm scenario. Note the impact-metric tension: the vendor set VI:L/SI:L, yet the described capability is read-only (SSRF/LFI), so integrity impact appears marginal - the confidentiality metrics (VC:H/SC:H) are the meaningful drivers.

A low-privileged Leantime user who can create content on a project submits a Blueprints import request via the JSON-RPC API with a filename of http://169.254.169.254/latest/meta-data/iam/security-credentials/ or file:///etc/passwd. The server calls file_get_contents() on that value, and the response (cloud IAM credentials or local file contents) is returned or ingested, letting the attacker harvest secrets. Publicly available PoC code (GHSA-gphg-6h4g-mg22) demonstrates the technique, and the low attack complexity means it is straightforward to reproduce.