CVE-2026-45419
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In DataEase prior to version 2.10.23, a vulnerability was found due to insufficient path validation in template saving endpoints. An attacker can use attacker-controlled static resource names and Base64 content to perform path traversal and arbitrary file writes on the server.
Risk Assessment
The risk for the organization includes the possibility of remotely writing malicious files to the server, which could lead to system compromise, data theft, or unauthorized code execution.
Recommendation
Immediately update DataEase to version 2.10.23 or later, which includes a fix that eliminates the path traversal and unsafe file write vulnerability.
Other vulnerabilities in DataEase
See all- CVE-2026-45532High
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.
- CVE-2026-46684Critical
In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.
- CVE-2026-45534Critical
In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.
- CVE-2025-64428Critical
Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.
- CVE-2026-50124High
A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.
- CVE-2026-50030High
A vulnerability in DataEase before version 2.10.23 allows arbitrary SQL read queries on connected datasources. The SQL preview function does not enforce table access restrictions.
- CVE-2026-49867Medium
In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.
- CVE-2026-45535High
In DataEase prior to version 2.10.23, SQL-type datasets store attacker-controlled SQL variable default values such as ${var}, and SqlparserUtils.handleVariableDefaultValue() inserts them using String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset.
- CVE-2026-45533High
In DataEase prior to version 2.10.23, a vulnerability was found in the bulk delete API endpoint where path traversal sequences like ../ are not sanitized. Attackers can delete arbitrary server directories through the export task cleanup mechanism.
- CVE-2026-45417High
In DataEase prior to version 2.10.23, a SQL injection vulnerability was found in the datasource connection status check function. An attacker can exploit the schema parameter in the SQL query, leading to unauthorized data access.
Original NVD description (English source)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing path traversal and arbitrary file writes because only / was used when extracting the file name. This issue is fixed in version 2.10.23.