Dataease CVE-2026-32939

Requires DataEase versions 2.10.19 and below running on a system with Turkish locale (tr_TR) JVM default locale. Remote unauthenticated attacker can bypass JDBC URL validation by exploiting locale-specific character conversion (lowercase 'i' to 'İ') to inject malicious H2 database parameters.

The CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) but requires network access with high attack complexity, present attack timing, and low privileges (AV:N/AC:H/AT:P/PR:L). The high attack complexity and present attack timing requirements indicate this is not trivially exploitable—it requires specific environmental conditions (Turkish or similar locale settings) that significantly limit the attack surface. While the vulnerability has been confirmed exploitable in real deployments, there is no EPSS score provided, no evidence of KEV listing indicating active exploitation, and no public proof-of-concept available. The real-world risk is moderate: organizations running DataEase in Turkish locale environments with authenticated users face genuine risk of JDBC injection attacks, but the narrow environmental prerequisite (specific locale settings) and authentication requirement substantially reduce the likelihood of widespread exploitation compared to the base CVSS score suggests. This should be prioritized for patching in affected locale environments but is not an emergency for typical English-locale deployments.

An authenticated attacker with low-level privileges targeting a DataEase instance running in a Turkish locale environment crafts a malicious database connection request containing JDBC parameters like 'iNIT' (lowercase with carefully chosen casing). When DataEase validates the request using its default Turkish locale, the string becomes 'İNIT' which bypasses the security blacklist, but when H2 JDBC processes the same parameter using English locale rules, it correctly interprets it as 'INIT' and executes arbitrary initialization code, allowing the attacker to gain database access, execute system commands, or exfiltrate sensitive business intelligence data stored in the visualization platform.