# CVE-2026-45532: DataEase path traversal in static resource endpoint

Source: https://junglewise.ai/threats/cve-2026-45532-dataease-path-traversal-in-static-resource-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45532 · Severity: info · CVSS 7.5 · Published 2026-08-18

DataEase is an open-source data visualization and analysis platform used for creating dashboards and reports. A path traversal vulnerability in its static resource handler allows unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or system files. The flaw affects all versions prior to 2.10.23.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-45532 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45532 being exploited in the wild.

**How severe is CVE-2026-45532?** Informational severity, with a CVSS score of 7.5, published 18 August 2026.

**Which products and versions are affected?** DataEase prior to 2.10.23.

**Is there a fix for CVE-2026-45532?** A patch was published on 2026-05-28: fixed in v2.10.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45532 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-45532?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `StaticResourceServer#findResourceAsBase64` and `StaticResourceUtils#getImgFileToBase64` methods. On Windows systems, the path separator is a backslash (\), but the server's path traversal filter only checks for forward slashes (/). An attacker can bypass the filter by using backslash sequences (e.g., `..\..\..\..\windows\win.ini`) to traverse the directory structure and read arbitrary files. The vulnerable endpoint `/de2api/staticResource/findResourceAsBase64` accepts a JSON POST request with a `resourcePathList` parameter and returns file contents encoded in Base64, requiring no authentication. The fix in v2.10.23 properly validates both forward and backward slashes in path inputs.

## Affected products

- DataEase DataEase prior to 2.10.23

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: patched: fixed in v2.10.23

## References

- [https://github.com/dataease/dataease/releases/tag/v2.10.23](https://github.com/dataease/dataease/releases/tag/v2.10.23)
- [https://github.com/dataease/dataease/security/advisories/GHSA-2mqc-w4hm-f3p9](https://github.com/dataease/dataease/security/advisories/GHSA-2mqc-w4hm-f3p9)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)