CVE-2026-19762
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
Risk Assessment
A remote attacker can read or write arbitrary files on the server, potentially leading to disclosure of sensitive data, modification of system files, or application compromise.
Recommendation
Update DTStack Taier to a patched version. If not possible, restrict access to the Chunk-Check endpoint and apply input validation for the Name argument.
Other vulnerabilities in DTStack Taier
See all- CVE-2026-19763Low
A vulnerability was determined in DTStack Taier version 1.4.0, affecting the FileUtils.deleteDirectory function in ClusterController.java. Manipulation of the clusterName argument causes path traversal. Remote exploitation is possible.
- CVE-2026-19761Medium
A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.
- CVE-2026-11618High
DTStack Taier up to version 1.4.0 has a vulnerability in the preHandle function in LoginInterceptor.java related to the source connection test endpoint. Remote exploitation can bypass authentication. Exploit publicly disclosed.
- CVE-2026-9437Medium
A vulnerability in DTStack Taier 1.4.0. The Runtime.exec function in the REST API component allows OS command injection via the sqlText argument. Remote attack, exploit public.
Original NVD description (English source)
A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS