CVE-2024-0849

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

Score

CVSS 3.1 5.5 Medium

Status

Modified - help@fluidattacks.com

Published

2024-02-07

Last modified

2026-04-20

Weaknesses

CWE-22

Affected products

• Desktop (Leanote)
• Leanote (Leanote)

References

• https://fluidattacks.com/advisories/alesso
• https://github.com/leanote/desktop-app