CVE-2024-2825 is a Medium severity (CVSS 6.3) flaw in lakernote EasyAdmin up to the 20240315 snapshot: path traversal through the file argument of /ureport/designer/saveReportFile. The exploit is publicly disclosed. No fixed version is listed. Restrict access to the admin application and check the project page.
What's affected
- Product: lakernote EasyAdmin, a Java admin framework.
- Affected: versions up to 20240315.
- Fixed: none listed in the record.
- Weakness: CWE-24.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The record describes path traversal through the file argument of /ureport/designer/saveReportFile. VulDB tracks it as VDB-257715.
Severity note: VulDB labels this issue critical in its description, while the CVSS base score is 6.3 (Medium). Both appear in the record.
How to check if you're exposed
EasyAdmin is a Java project that you build and deploy yourself, so check your own source and build.
- Search your repositories for the project:
grep -rIl "com.laker.admin" . - Check the project snapshot or commit date. Anything at or before 15 March 2024 is in range.
- Check whether the admin application is reachable from the internet.
- Review your logs for unusual requests to the path named above.
What to do now
- Find every deployment or fork built from EasyAdmin.
- Restrict the admin application to a trusted network or VPN.
- Update to a build that includes the project's fix, and read the project's Gitee issue first to see what it says.
- Enforce strong credentials, since the vector needs a low privilege account.
- Rebuild and redeploy, then confirm the running build is newer than 20240315.
Why it matters
Path traversal lets a request reach files outside the directory the application meant to expose, usually by supplying sequences that climb out of the intended folder. Here the weakness is filed under the specific variant that uses the parent directory form.
Any endpoint that saves or reads a file by a user supplied name needs to resolve the final path and confirm it stays inside an allowed directory.
The flaw sits in an admin framework, which is exactly the kind of component teams embed and forget. Four related CVEs in the same project came out on the same day, which suggests the code around report saving and URL fetching deserves a wider review rather than one by one fixes.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Is the exploit public?
The record says the exploit has been disclosed to the public and may be used. It does not say it is used in attacks.
Which version is fixed?
The record does not name one. Check the project page.
Sources
Record references (not all retrievable when we reviewed this post):
- https://gitee.com/lakernote/easy-admin/issues/I98ZTA
- https://vuldb.com/?ctiid.257715
- https://vuldb.com/?id.257715
Last reviewed: 19 October 2026.
