PT-2026-33351 · Dataease · Dataease

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-33082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description The dataset export functionality allows for SQL injection. The expressionTree parameter in the endpoint '/de2api/datasetTree/exportDataset' is deserialized into a filtering object and passed to the WhereTree2Str.transFilterTrees() function for SQL translation. User-controlled values in "like" filter terms are directly concatenated into SQL fragments without sanitization. This allows an attacker to inject arbitrary SQL commands by escaping the string literal in the filter value, enabling blind SQL injection, such as time-based extraction of database information.

Recommendations Update to version 2.10.21.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33082

Affected Products

Dataease

References · 4

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-xxpw-2c8q-g693 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33082 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://twitter.com/CVEnew/status/2045102665638551857 · Twitter Post