CVE-2026-45532
HighCVSS 8.7Summary
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.
Risk Assessment
An attacker could exploit this vulnerability to access files outside the intended directory, potentially leading to disclosure of sensitive data or system compromise.
Recommendation
It is recommended to update DataEase to version 2.10.23 or later as soon as possible to mitigate the vulnerability.
Original NVD description (English source)
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FILE_SEPARATOR` is `\`, while the server only filters the `/` character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.