PT-2025-42628 · Dataease · Dataease

Published 2025-10-17 · Updated 2025-10-24 · CVE-2025-62421

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13

Description DataEase is a data visualization and analytics platform. A stored cross-site scripting issue exists because of inadequate file upload validation and authentication bypass. The upload/{fileId} route within the StaticResourceApi interface allows users to control the filename and extension of uploaded files. The WhitelistUtils#match method incorrectly deems URLs ending with extensions like .js as safe, bypassing permission checks. This enables attackers to upload HTML files containing malicious JavaScript by specifying arbitrary file extensions, such as accessing "upload/1.js". The TokenFilter is involved in the permission validation process.

Recommendations Update to version 2.10.14 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62421

GHSA-2WMV-RR3P-PF43

Affected Products

Dataease

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62421.json · Exploit
• https://github.com/dataease/dataease/security/advisories/GHSA-2wmv-rr3p-pf43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62421 · Security Note
• https://twitter.com/VulmonFeeds/status/1979266523416899833 · Twitter Post
• https://t.me/CVEtracker/35203 · Telegram Post
• https://twitter.com/CVEnew/status/1979289028458426546 · Twitter Post
• https://t.me/cveNotify/139231 · Telegram Post
• https://t.me/cveNotify/140153 · Telegram Post