# CVE-2026-50124: DataEase RCE via Zip Protocol and H2 Database File Upload

Source: https://junglewise.ai/threats/cve-2026-50124-dataease-rce-via-zip-protocol-and-h2-database-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-50124 · Severity: info · CVSS 7.1 · Published 2026-07-15

DataEase is an open-source data visualization and analysis tool used to create business dashboards. A vulnerability exists that allows an authorized user to execute malicious code on the server by uploading a specially crafted ZIP file through the Excel data import feature. This could lead to a complete compromise of the server, unauthorized access to sensitive data, or disruption of business operations.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-50124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50124 being exploited in the wild.

**How severe is CVE-2026-50124?** Informational severity, with a CVSS score of 7.1, published 15 July 2026.

**Which products and versions are affected?** DataEase < 2.10.23.

**Is there a fix for CVE-2026-50124?** A patch was published on 2026-05-18: Initial fix commits pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50124 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50124?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Remote Code Execution (RCE) vulnerability exists in DataEase due to an unrestricted file upload flaw (CWE-434) combined with insecure H2 database protocol handling. An authenticated attacker can bypass JDBC URL blacklists by uploading a malicious H2 database file disguised as a ZIP file via the '/datasource/upload' Excel API. By subsequently creating a new H2 datasource using the 'zip:' protocol to point to the uploaded file, the attacker can trigger the execution of pre-compiled Java aliases stored within the database when the backend engine (CalciteProvider) executes a query. This allows for arbitrary code execution on the host system. The vulnerability is addressed in version 2.10.23 by implementing stricter file suffix validation and centralized JDBC URL/Driver security policies.

## Affected products

- DataEase DataEase < 2.10.23

## Timeline

- 2026-05-18: patched: Initial fix commits pushed to repository
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285](https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285)
- [https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1](https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1)
- [https://github.com/dataease/dataease/releases/tag/v2.10.23](https://github.com/dataease/dataease/releases/tag/v2.10.23)
- [https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v](https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)