Quick answers
- Is CVE-2026-45532 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45532 being exploited in the wild.
- How severe is CVE-2026-45532?
- Informational severity, with a CVSS score of 7.5, published 18 August 2026.
- Which products and versions are affected?
- DataEase prior to 2.10.23.
- Is there a fix for CVE-2026-45532?
- A patch was published on 2026-05-28: fixed in v2.10.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45532 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-45532?
- Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the `StaticResourceServer#findResourceAsBase64` and `StaticResourceUtils#getImgFileToBase64` methods. On Windows systems, the path separator is a backslash (\), but the server's path traversal filter only checks for forward slashes (/). An attacker can bypass the filter by using backslash sequences (e.g., `..\..\..\..\windows\win.ini`) to traverse the directory structure and read arbitrary files. The vulnerable endpoint `/de2api/staticResource/findResourceAsBase64` accepts a JSON POST request with a `resourcePathList` parameter and returns file contents encoded in Base64, requiring no authentication. The fix in v2.10.23 properly validates both forward and backward slashes in path inputs.
Affected products
- DataEase DataEase prior to 2.10.23
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: fixed in v2.10.23