# CVE-2026-55633: DataEase remote code execution via H2 zip protocol bypass in FontManage

Source: https://junglewise.ai/threats/cve-2026-55633-dataease-remote-code-execution-via-h2-zip-protocol-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-55633 · Severity: info · CVSS 8.7 · Published 2026-07-07

DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands on the server. By uploading a malicious file disguised as a font file, an attacker can bypass existing security filters to gain full control over the application environment. This could lead to total data theft, service disruption, or further attacks on the internal network. Users are advised to upgrade to version 2.10.24 immediately to resolve this issue.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-55633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55633 being exploited in the wild.

**How severe is CVE-2026-55633?** Informational severity, with a CVSS score of 8.7, published 7 July 2026.

**Which products and versions are affected?** DataEase < 2.10.24.

**Is there a fix for CVE-2026-55633?** A patch was published on 2026-06-18: Version 2.10.24 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55633 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55633?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a bypass of a previous fix for GHSA-cjmg-jqmc-xj5v. While the original fix implemented a file extension whitelist in the DatasourceServer component, the FontManage.saveFile endpoint remained vulnerable. This endpoint only validates that a filename ends with '.ttf' without inspecting the actual file content. An authenticated attacker can upload a ZIP archive renamed with a .ttf extension; once written to disk, the attacker can leverage the H2 database engine's 'zip' protocol to access the archive and execute arbitrary code. The issue is addressed in version 2.10.24 by improving file validation and path handling.

## Affected products

- DataEase DataEase < 2.10.24

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-18: patched: Version 2.10.24 released
- 2026-07-07: disclosed: CVE-2026-55633 published to NVD

## References

- [https://github.com/dataease/dataease/commit/265b31179f1427c059f739841f2e39aaa6d1b937](https://github.com/dataease/dataease/commit/265b31179f1427c059f739841f2e39aaa6d1b937)
- [https://github.com/dataease/dataease/commit/8892a6945b0b7a329a156155270fae58afa895bc](https://github.com/dataease/dataease/commit/8892a6945b0b7a329a156155270fae58afa895bc)
- [https://github.com/dataease/dataease/releases/tag/v2.10.24](https://github.com/dataease/dataease/releases/tag/v2.10.24)
- [https://github.com/dataease/dataease/security/advisories/GHSA-8x36-774q-pwqg](https://github.com/dataease/dataease/security/advisories/GHSA-8x36-774q-pwqg)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)