PT-2026-25036 · Dataease+1 · Dataease

Fushuling · Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-32140

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dataease versions prior to 2.10.20

Description Dataease is an open source data visualization analysis tool. Prior to version 2.10.20, controlling the IniFile parameter allows an attacker to force the JDBC driver to load an attacker-controlled configuration file. This configuration file can inject dangerous JDBC properties, leading to remote code execution. The vulnerability resides in the getJdbcIniFile method, which aggressively searches for a configuration file named rsjdbc.ini if not explicitly restricted. Within a JDBC URL context, users can specify the configuration file via URL parameters, enabling the loading of arbitrary files on the server as JDBC configuration files. The IniFile parameter within the Redshift JDBC driver properties is explicitly supported and used to load external configuration files.

Recommendations Versions prior to 2.10.20 should be updated to version 2.10.20 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32140

GHSA-JC9Q-3JFW-MCH4

Affected Products

Dataease

References · 7

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-jc9q-3jfw-mch4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32140.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32140 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32140 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2032490938879418870 · Twitter Post
• https://twitter.com/CVEnew/status/2032230685675606350 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032160696801149412 · Twitter Post