PT-2026-56251 · Dataease · Dataease

Catherines77 · Publicado 2026-07-07 · Atualizado 2026-07-07 · CVE-2026-55633

Mitre

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution. This issue is fixed in version 2.10.24.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-55633

Produtos afetados

Dataease

Referências · 5

• https://github.com/dataease/dataease/commit/265b31179f1427c059f739841f2e39aaa6d1b937 · Nota
• https://github.com/dataease/dataease/commit/8892a6945b0b7a329a156155270fae58afa895bc · Nota
• https://github.com/dataease/dataease/releases/tag/v2.10.24 · Nota
• https://github.com/dataease/dataease/security/advisories/GHSA-8x36-774q-pwqg · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55633 · Nota de Segurança