CVE-2024-0849 - Leanote 2.7.0 - Local File Read

MEDIUM

Leanote 2.7.0 - Local File Read

Published Feb 7, 2024

5.5

MEDIUM

CVSS 3.1

EPSS 0.23%

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Leanote	Leanote	unaffected	Affected 2.7.0

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16632		Advisory
https://fluidattacks.com/advisories/alesso		Third Party Advisory
https://github.com/leanote/desktop-app		Product

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Fluid Attacks

Published Feb 7, 2024

Updated Apr 20, 2026

Reserved Jan 24, 2024

CISA Vulnrichment

Updated May 8, 2025

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner Fluid Attacks

Published Feb 7, 2024

Updated Apr 20, 2026

GitHub

No data