Executive brief
DataEase is an open-source data visualization and analysis tool used to create business dashboards. A vulnerability exists that allows an authorized user to execute malicious code on the server by uploading a specially crafted ZIP file through the Excel data import feature. This could lead to a complete compromise of the server, unauthorized access to sensitive data, or disruption of business operations.
Technical details
A Remote Code Execution (RCE) vulnerability exists in DataEase due to an unrestricted file upload flaw (CWE-434) combined with insecure H2 database protocol handling. An authenticated attacker can bypass JDBC URL blacklists by uploading a malicious H2 database file disguised as a ZIP file via the '/datasource/upload' Excel API. By subsequently creating a new H2 datasource using the 'zip:' protocol to point to the uploaded file, the attacker can trigger the execution of pre-compiled Java aliases stored within the database when the backend engine (CalciteProvider) executes a query. This allows for arbitrary code execution on the host system. The vulnerability is addressed in version 2.10.23 by implementing stricter file suffix validation and centralized JDBC URL/Driver security policies.
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-18: patched: Initial fix commits pushed to repository
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD
References
- https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285
- https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1
- https://github.com/dataease/dataease/releases/tag/v2.10.23
- https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v