Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by p…

Leantime version 3.6.2 contains a server-side request forgery (SSRF) and local file inclusion (LFI) vulnerability in the Blueprints::import() method. The flaw arises from passing unsanitized user-supplied filenames directly to PHP's file_get_contents() function without path validation. Authenticated attackers can exploit this via the JSON-RPC API endpoint by submitting crafted filenames containing URL wrappers or path traversal sequences. Successful exploitation allows attackers to access cloud metadata services or read arbitrary files from the server filesystem. The vulnerability requires authentication but poses significant risk due to potential exposure of sensitive internal resources and cloud infrastructure metadata. A pull request has been submitted to address the issue, and a proof-of-concept advisory has been published on GitHub.