CVE-2026-50124

EUVD-2026-44780

15.07.2026, 20:17

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	7.1 HIGH	NETWORK	LOW	LOW	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
dataease	dataease	𝑥 < 2.10.23	CNA

Common Weakness Enumeration

CWE-434 - Unrestricted Upload of File with Dangerous Type
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

References

https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285

https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1

https://github.com/dataease/dataease/releases/tag/v2.10.23

https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v