Executive brief
DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands on the server. By uploading a malicious file disguised as a font file, an attacker can bypass existing security filters to gain full control over the application environment. This could lead to total data theft, service disruption, or further attacks on the internal network. Users are advised to upgrade to version 2.10.24 immediately to resolve this issue.
Technical details
This vulnerability is a bypass of a previous fix for GHSA-cjmg-jqmc-xj5v. While the original fix implemented a file extension whitelist in the DatasourceServer component, the FontManage.saveFile endpoint remained vulnerable. This endpoint only validates that a filename ends with '.ttf' without inspecting the actual file content. An authenticated attacker can upload a ZIP archive renamed with a .ttf extension; once written to disk, the attacker can leverage the H2 database engine's 'zip' protocol to access the archive and execute arbitrary code. The issue is addressed in version 2.10.24 by improving file validation and path handling.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-18: patched: Version 2.10.24 released
- 2026-07-07: disclosed: CVE-2026-55633 published to NVD
References
- https://github.com/dataease/dataease/commit/265b31179f1427c059f739841f2e39aaa6d1b937
- https://github.com/dataease/dataease/commit/8892a6945b0b7a329a156155270fae58afa895bc
- https://github.com/dataease/dataease/releases/tag/v2.10.24
- https://github.com/dataease/dataease/security/advisories/GHSA-8x36-774q-pwqg