Is CVE-2026-19762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19762 being exploited in the wild.

How severe is CVE-2026-19762?

High severity, with a CVSS score of 7.3, published 14 August 2026.

Is there a fix for CVE-2026-19762?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19762 attacked?

It is attacked over the network.

Am I affected by CVE-2026-19762?

Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19762: DTStack Taier path traversal in chunk upload endpoint

CVE-2026-19762 · Severity: high · CVSS 7.3 · Published 2026-08-14

DTStack Taier is a big data development platform for workflow submission and scheduling. A deprecated but still-active file upload endpoint accepts unsanitized file paths, allowing attackers to probe for the existence of arbitrary files on the server and determine their exact size through response timing or behavioral differences. This enables information disclosure of sensitive system files without authentication.

Technologies: DTStack Taier. Vendors: DTStack.

Quick answers

Is CVE-2026-19762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19762 being exploited in the wild.
How severe is CVE-2026-19762?: High severity, with a CVSS score of 7.3, published 14 August 2026.
Which products and versions are affected?: DTStack Taier 1.4.0.
Is there a fix for CVE-2026-19762?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19762 attacked?: It is attacked over the network.
Am I affected by CVE-2026-19762?: Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal (CWE-22) in the FileChunkController's /chunk/check endpoint. The controller concatenates an attacker-controlled "name" parameter directly into a file path using Paths.get() without canonicalization or validation, then returns a boolean indicating whether the file exists and its size matches. An attacker can supply traversal sequences (../) or absolute paths to enumerate arbitrary files and learn their exact byte length. The endpoint is marked @Deprecated and @Hidden but remains mapped and reachable; no authentication or URI-level authorization is enforced. Exploitation requires only network access to POST a JSON payload to /chunk/check.

Affected products

DTStack Taier 1.4.0

Timeline

2026-08-14: disclosed
2026-06-25: other: Vulnerability reported on GitHub issue #1203

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.