Executive brief
DTStack Taier is a big data development platform used for scheduling and managing data processing workflows. A path traversal vulnerability in the cluster creation component allows remote attackers to manipulate file paths and access or delete files outside their intended directory, potentially compromising data integrity or system availability.
Technical details
A path traversal vulnerability exists in DTStack Taier 1.4.0 within the FileUtils.deleteDirectory function in ClusterController.java of the Cluster Creation component. The vulnerability is caused by insufficient validation of the clusterName argument, which is used to construct file paths without proper sanitization. An attacker can supply a crafted clusterName containing path traversal sequences (e.g., "../") to access files outside the intended directory. The vulnerability is remotely exploitable and does not appear to require authentication. Upgrading to version 1.5.0 or applying patch ec8c59c76aceb04ab3080543ab2d9c6a4b674729 resolves this issue by adding validation of zip entry names before path construction.
Affected products
- DTStack Taier 1.4.0
Timeline
- 2026-08-14: disclosed
- 2026-07-21: patched: Patch ec8c59c76aceb04ab3080543ab2d9c6a4b674729 committed; fix available in version 1.5.0