CVE-2024-2826 is a Medium severity (CVSS 6.3) flaw in lakernote EasyAdmin up to the 20240315 snapshot: XML external entity reference in /ureport/designer/saveReportFile. The exploit is publicly disclosed. No fixed version is listed. Restrict access to the admin application and check the project page.
What's affected
- Product: lakernote EasyAdmin, a Java admin framework.
- Affected: versions up to 20240315.
- Fixed: none listed in the record.
- Weakness: CWE-611.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The record describes XML external entity reference in /ureport/designer/saveReportFile. VulDB tracks it as VDB-257716.
Severity note: VulDB labels this issue problematic in its description, while the CVSS base score is 6.3 (Medium). Both appear in the record.
How to check if you're exposed
EasyAdmin is a Java project that you build and deploy yourself, so check your own source and build.
- Search your repositories for the project:
grep -rIl "com.laker.admin" . - Check the project snapshot or commit date. Anything at or before 15 March 2024 is in range.
- Check whether the admin application is reachable from the internet.
- Review your logs for unusual requests to the path named above.
What to do now
- Find every deployment or fork built from EasyAdmin.
- Restrict the admin application to a trusted network or VPN.
- Update to a build that includes the project's fix, and read the project's Gitee issue first to see what it says.
- Enforce strong credentials, since the vector needs a low privilege account.
- Rebuild and redeploy, then confirm the running build is newer than 20240315.
Why it matters
XML external entity (XXE) processing happens when an XML parser is allowed to resolve references to external resources defined inside the document. A document can then make the server read local files or contact other systems.
The usual fix is configuration: turn off external entity and document type definition handling in the parser, or use a parser mode that ignores them.
The flaw sits in an admin framework, which is exactly the kind of component teams embed and forget. Four related CVEs in the same project came out on the same day, which suggests the code around report saving and URL fetching deserves a wider review rather than one by one fixes.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Is the exploit public?
The record says the exploit has been disclosed to the public and may be used. It does not say it is used in attacks.
Which version is fixed?
The record does not name one. Check the project page.
Sources
Record references (not all retrievable when we reviewed this post):
- https://gitee.com/lakernote/easy-admin/issues/I98ZTA
- https://vuldb.com/?ctiid.257716
- https://vuldb.com/?id.257716
Last reviewed: 19 October 2026.
