This issue allows an attacker to bypass intended access controls to read sensitive files from the underlying server filesystem, such as configuration files, or to conduct SSRF attacks to target internal services and cloud metadata endpoints. Because the vulnerability is reachable through the application's JSON-RPC API, any authenticated user - including those with low-privileged accounts - can escalate their access to extract system information or perform internal reconnaissance, potentially leading to full system compromise depending on the server configuration.

Impact

Successful exploitation allows authenticated attackers to perform arbitrary file reads or pivot into internal network infrastructure. This vulnerability poses a significant risk to organizations hosting Leantime in cloud environments, where attackers may retrieve metadata credentials. Unauthorized access to system configuration files may lead to the exposure of database credentials, encryption keys, and other secrets, facilitating further exploitation or data exfiltration.

Recommendation

1. Upgrade Leantime instances to the latest secure version immediately to remediate CVE-2026-66415.
2. Implement strict input validation and sanitization for all parameters passed to file-system related functions in the application code.
3. Restrict access to the JSON-RPC API to trusted users and monitor API logs for anomalous requests containing path traversal characters or URL protocols.
4. Enforce principle of least privilege for the service account running the Leantime application to limit the scope of potential file access.