DTStack Taier CVE-2026-19762

No special authentication is required - the CVSS 4.0 vector PR:N and UI:N confirm the Chunk-Check Endpoint is accessible to unauthenticated remote attackers. The exploitation condition is that DTStack Taier must be network-reachable and running version 1.4.0 (or potentially earlier versions). The specific feature required is the chunked file upload pre-check functionality exposed by FileChunkController.java; if this endpoint is firewalled or the feature is disabled, exploitation is blocked. Limiting factors include: the Taier process user's OS-level file permissions constrain which files can be traversed (restricting Taier to a sandboxed user reduces impact); and the low VC/VI/VA CVSS ratings suggest the traversal scope may be partially bounded. No platform-specific, non-default configuration toggle is documented as required - the endpoint appears active in a default Taier 1.4.0 deployment.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L yields a score of 6.9, reflecting unauthenticated, low-complexity network exploitation with limited per-impact ratings. The supplemental E:P metric confirms a public proof-of-concept exists, which materially increases exploitation likelihood above what the base score alone conveys. This CVE is not listed in the CISA KEV catalog, so active widespread exploitation is not confirmed. No EPSS score was provided in the source data, leaving quantified exploitation probability unknown - this is a notable gap in the intelligence picture. The low C/I/A impact ratings suggest the traversal may be bounded by the operating system user context under which Taier runs, limiting but not eliminating risk. However, path traversal in a file-chunk endpoint could enable an attacker to read sensitive configuration files or overwrite application files, which may chain into higher-impact outcomes not captured by the standalone CVSS score. The absence of KEV listing and low individual impact metrics suggest this is a real but moderate-priority issue unless Taier instances are exposed to untrusted networks or handle sensitive data.

An unauthenticated remote attacker sends a crafted HTTP request to Taier's Chunk-Check Endpoint with the Name parameter set to a path traversal sequence such as '../../etc/passwd'. The Paths.get() call in FileChunkController.java resolves the manipulated path outside the intended upload directory, exposing the targeted file's existence or contents. Because a public proof-of-concept is available on GitHub, exploitation requires minimal attacker sophistication.