CyberRota Analysis
AI-GeneratedLeantime 3.6.2 is vulnerable to a server-side request forgery and local file inclusion flaw that enables authenticated attackers to exploit unsanitized user input, allowing them to read internal resources and access sensitive files on the server. This vulnerability poses a significant risk as it can lead to unauthorized data exposure, particularly for systems that rely on the JSON-RPC API endpoint. Organizations using this version of Leantime should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.