Is CVE-2026-50124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50124 being exploited in the wild.

How severe is CVE-2026-50124?

Informational severity, with a CVSS score of 7.1, published 15 July 2026.

Is there a fix for CVE-2026-50124?

A patch was published on 2026-05-18: Initial fix commits pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50124 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50124?

Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50124: DataEase RCE via Zip Protocol and H2 Database File Upload

CVE-2026-50124 · Severity: info · CVSS 7.1 · Published 2026-07-15

DataEase is an open-source data visualization and analysis tool used to create business dashboards. A vulnerability exists that allows an authorized user to execute malicious code on the server by uploading a specially crafted ZIP file through the Excel data import feature. This could lead to a complete compromise of the server, unauthorized access to sensitive data, or disruption of business operations.

Technologies: DataEase. Vendors: DataEase.

Quick answers

Is CVE-2026-50124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50124 being exploited in the wild.
How severe is CVE-2026-50124?: Informational severity, with a CVSS score of 7.1, published 15 July 2026.
Which products and versions are affected?: DataEase < 2.10.23.
Is there a fix for CVE-2026-50124?: A patch was published on 2026-05-18: Initial fix commits pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50124 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50124?: Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Remote Code Execution (RCE) vulnerability exists in DataEase due to an unrestricted file upload flaw (CWE-434) combined with insecure H2 database protocol handling. An authenticated attacker can bypass JDBC URL blacklists by uploading a malicious H2 database file disguised as a ZIP file via the '/datasource/upload' Excel API. By subsequently creating a new H2 datasource using the 'zip:' protocol to point to the uploaded file, the attacker can trigger the execution of pre-compiled Java aliases stored within the database when the backend engine (CalciteProvider) executes a query. This allows for arbitrary code execution on the host system. The vulnerability is addressed in version 2.10.23 by implementing stricter file suffix validation and centralized JDBC URL/Driver security policies.

Affected products

DataEase DataEase < 2.10.23

Timeline

2026-05-18: patched: Initial fix commits pushed to repository
2026-05-28: advisory: GitHub Security Advisory published
2026-07-15: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.