CVE-2026-9437
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
A vulnerability in DTStack Taier 1.4.0. The Runtime.exec function in the REST API component allows OS command injection via the sqlText argument. Remote attack, exploit public.
Risk Assessment
An attacker can remotely execute arbitrary commands on the Taier server, leading to full system and data compromise.
Recommendation
Update DTStack Taier to a patched version or apply temporary WAF rules blocking malicious requests.
Other vulnerabilities in DTStack Taier
See all- CVE-2026-19763Low
A vulnerability was determined in DTStack Taier version 1.4.0, affecting the FileUtils.deleteDirectory function in ClusterController.java. Manipulation of the clusterName argument causes path traversal. Remote exploitation is possible.
- CVE-2026-19762High
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
- CVE-2026-19761Medium
A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.
- CVE-2026-11618High
DTStack Taier up to version 1.4.0 has a vulnerability in the preHandle function in LoginInterceptor.java related to the source connection test endpoint. Remote exploitation can bypass authentication. Exploit publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.