Executive brief
DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw in its template management system. An attacker with basic user permissions can exploit this to write malicious files to any location on the server's hard drive. This could lead to a complete system takeover, data loss, or permanent disruption of the visualization service.
Technical details
A path traversal vulnerability exists in DataEase prior to version 2.10.23 within the `TemplateManageService#save` and `StaticResourceServer#saveFilesToServe` methods. The `/de2api/templateManage/save` endpoint accepts a `staticResource` parameter containing Base64-encoded content and a filename. The application incorrectly extracts the filename by only searching for the forward slash (`/`) character, failing to account for backslashes (`\`) or directory traversal sequences (`../`). An authenticated attacker can provide a crafted path (e.g., using `..\..\`) to write arbitrary files outside of the intended directory. This can be leveraged to overwrite critical system files or achieve remote code execution. The issue is resolved in version 2.10.23 by implementing proper filename extraction and validation.
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-28: patched: Version 2.10.23 released
- 2026-05-28: advisory: GitHub Security Advisory GHSA-83fh-fgh3-g9f9 published
- 2026-07-15: disclosed: CVE-2026-45419 published to NVD