The vulnerability resides in the Blueprints::import() method of Leantime 3.6.2, which calls file_get_contents() on user‑supplied filenames without validating the path or the protocol. This flaw originates from CWE‑918 and enables authenticated users to retrieve data from arbitrary locations inside the application or from cloud metadata services by embedding URL wrappers or path‑traversal sequences in the JSON‑RPC payload. The result is the unauthorized disclosure of internal resources, exposing sensitive configuration files or service metadata, and compromising confidentiality.

The affected product is Leantime. Users running version 3.6.2 of the Leantime web application are potentially compromised. No other versions are listed as affected in the CNA data.

The CVSS score of 8.4 indicates a high‑severity flaw. Because the attack requires authentication and only the JSON‑RPC API endpoint that serves Blueprints::import(), attackers need legitimate credentials; however, once obtained, the vulnerability allows for reading arbitrary files, so the potential impact is significant. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, suggesting that while it is serious, it may not yet be widely exploited in the wild. The likely attack vector is a targeted assault using valid user sessions against the API endpoint.