Leantime 3.6.2 is vulnerable to SSRF and LFI due to insufficient validation of user-supplied filenames passed to file_get_contents() in the Blueprints::import() method. The vulnerability is exploitable by authenticated users through the JSON-RPC API endpoint, enabling them to access internal server files or cloud metadata by submitting specially crafted filenames containing URL wrappers or path traversal sequences. This vulnerability is tracked as CVE-2026-66415 and is categorized under CWE-918 (Server-Side Request Forgery).

An authenticated attacker can read sensitive internal files and cloud metadata services, potentially exposing confidential information or credentials stored on the server. This can lead to further compromise of the system or cloud environment. The vulnerability does not allow privilege escalation or remote code execution directly but can facilitate information disclosure with high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the JSON-RPC API endpoint to trusted users only and monitor for suspicious activity involving file import operations. Avoid exposing sensitive internal resources and cloud metadata services to the application environment.