Is CVE-2026-55633 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55633 being exploited in the wild.

How severe is CVE-2026-55633?

Informational severity, with a CVSS score of 8.7, published 7 July 2026.

Is there a fix for CVE-2026-55633?

A patch was published on 2026-06-18: Version 2.10.24 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55633 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55633?

Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55633: DataEase remote code execution via H2 zip protocol bypass in FontManage

CVE-2026-55633 · Severity: info · CVSS 8.7 · Published 2026-07-07

DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands on the server. By uploading a malicious file disguised as a font file, an attacker can bypass existing security filters to gain full control over the application environment. This could lead to total data theft, service disruption, or further attacks on the internal network. Users are advised to upgrade to version 2.10.24 immediately to resolve this issue.

Technologies: DataEase. Vendors: DataEase.

Quick answers

Is CVE-2026-55633 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55633 being exploited in the wild.
How severe is CVE-2026-55633?: Informational severity, with a CVSS score of 8.7, published 7 July 2026.
Which products and versions are affected?: DataEase < 2.10.24.
Is there a fix for CVE-2026-55633?: A patch was published on 2026-06-18: Version 2.10.24 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55633 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55633?: Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a bypass of a previous fix for GHSA-cjmg-jqmc-xj5v. While the original fix implemented a file extension whitelist in the DatasourceServer component, the FontManage.saveFile endpoint remained vulnerable. This endpoint only validates that a filename ends with '.ttf' without inspecting the actual file content. An authenticated attacker can upload a ZIP archive renamed with a .ttf extension; once written to disk, the attacker can leverage the H2 database engine's 'zip' protocol to access the archive and execute arbitrary code. The issue is addressed in version 2.10.24 by improving file validation and path handling.

Affected products

DataEase DataEase < 2.10.24

Timeline

2026-06-18: advisory: GitHub Security Advisory published
2026-06-18: patched: Version 2.10.24 released
2026-07-07: disclosed: CVE-2026-55633 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.