Quick answers
- Is CVE-2026-19763 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19763 being exploited in the wild.
- How severe is CVE-2026-19763?
- Low severity, with a CVSS score of 3.8, published 14 August 2026.
- Which products and versions are affected?
- DTStack Taier 1.4.0.
- Is there a fix for CVE-2026-19763?
- A patch was published on 2026-07-21: Patch ec8c59c76aceb04ab3080543ab2d9c6a4b674729 committed; fix available in version 1.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19763 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-19763?
- Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in DTStack Taier 1.4.0 within the FileUtils.deleteDirectory function in ClusterController.java of the Cluster Creation component. The vulnerability is caused by insufficient validation of the clusterName argument, which is used to construct file paths without proper sanitization. An attacker can supply a crafted clusterName containing path traversal sequences (e.g., "../") to access files outside the intended directory. The vulnerability is remotely exploitable and does not appear to require authentication. Upgrading to version 1.5.0 or applying patch ec8c59c76aceb04ab3080543ab2d9c6a4b674729 resolves this issue by adding validation of zip entry names before path construction.
Affected products
- DTStack Taier 1.4.0
Timeline
- 2026-08-14: disclosed
- 2026-07-21: patched: Patch ec8c59c76aceb04ab3080543ab2d9c6a4b674729 committed; fix available in version 1.5.0