CVE-2026-41419 affects 4ga Boards, a realtime project management system. A path traversal vulnerability in versions prior to 3.3.5 allows authenticated users with board import privileges to exploit the BOARDS archive import feature. Attackers can make the server ingest arbitrary host files as board attachments during import. Once imported, these files can be downloaded through the normal application interface, leading to unauthorized local file disclosure. The vulnerability has been patched in version 3.3.5.