EUVD-2026-51245
GHSA-rfxf-9pcf-q3rq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network JSON-RPC endpoint with low-privilege authenticated user (PR:L), read-only SSRF/LFI so C:H but I:N/A:N, and S:C because the SSRF reaches internal metadata systems beyond the app's authorization scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.
AnalysisAI
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server into reading attacker-chosen resources by feeding unsanitized filenames to file_get_contents() inside the Blueprints::import() method. Because the JSON-RPC import endpoint accepts PHP URL wrappers and path-traversal sequences, a low-privileged user with project CREATE rights can pivot to cloud metadata endpoints (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Leantime account (CVSS PR:L) that holds CREATE authorization on a target project, and a reachable JSON-RPC API endpoint that exposes the Blueprints import operation; the attacker supplies a crafted filename containing a PHP URL wrapper (http://, ftp://, file://, php://) or ../ traversal sequence to Blueprints::import(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 8.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/SC:H, meaning network-reachable, low-complexity, low-privilege exploitation with high confidentiality impact on both the vulnerable system and a subsequent system (the SSRF target) - the SC:H is what elevates this beyond a plain file read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged Leantime user who can create content on a project submits a Blueprints import request via the JSON-RPC API with a filename of http://169.254.169.254/latest/meta-data/iam/security-credentials/ or file:///etc/passwd. The server calls file_get_contents() on that value, and the response (cloud IAM credentials or local file contents) is returned or ingested, letting the attacker harvest secrets. … |
| Remediation | Upgrade to the Leantime release that incorporates PR #3656 (https://github.com/Leantime/leantime/pull/3656); an upstream fix is available (PR/commit), but a released patched version number was not independently confirmed in the available data, so verify the fixed tag against the Leantime repository (https://github.com/Leantime/leantime) and the VulnCheck advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Leantime 3.6.2 instances, immediately disable or restrict access to the JSON-RPC import endpoint, and review access logs and file read operations for signs of exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in th
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted P
Leantime is an open source project management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely e
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do ti
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUr
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. Rated high severity (CVSS 8.8), this vu
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Rated medium severity (CVSS 4.7),
Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row
Login CSRF (session fixation) in Leantime's OpenID Connect authentication flow allows an attacker to authenticate a vict
Horizontal privilege escalation in Leantime through 3.6.2 allows any authenticated user to read live TOTP secrets or str
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today