Executive brief
DataEase is an open-source data visualization and analysis platform used for creating dashboards and reports. A path traversal vulnerability in its static resource handler allows unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or system files. The flaw affects all versions prior to 2.10.23.
Technical details
The vulnerability exists in the `StaticResourceServer#findResourceAsBase64` and `StaticResourceUtils#getImgFileToBase64` methods. On Windows systems, the path separator is a backslash (\), but the server's path traversal filter only checks for forward slashes (/). An attacker can bypass the filter by using backslash sequences (e.g., `..\..\..\..\windows\win.ini`) to traverse the directory structure and read arbitrary files. The vulnerable endpoint `/de2api/staticResource/findResourceAsBase64` accepts a JSON POST request with a `resourcePathList` parameter and returns file contents encoded in Base64, requiring no authentication. The fix in v2.10.23 properly validates both forward and backward slashes in path inputs.
Affected products
- DataEase DataEase prior to 2.10.23
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: fixed in v2.10.23