I98Ztalakernote

**Name of the Vulnerable Software and Affected Versions** lakernote EasyAdmin up to 20240315 **Description** A critical vulnerability has been found in lakernote EasyAdmin, affecting an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the `file` argument leads to path traversal, allowing an attacker to access files outside the intended directory, such as '../filedir'. This issue can be exploited remotely. The exploit has been disclosed to the public. **Recommendations** For lakernote EasyAdmin up to 20240315, consider restricting access to the /ureport/designer/saveReportFile endpoint until a patch is available. As a temporary workaround, avoid using the `file` argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** lakernote EasyAdmin up to 20240315 **Description** A vulnerability was found in lakernote EasyAdmin, affecting unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. **Recommendations** For lakernote EasyAdmin up to 20240315, consider restricting access to the /ureport/designer/saveReportFile endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.