Which versions of DataEase are affected by CVE-2026-45419?

DataEase versions before 2.10.23 contain an arbitrary file write vulnerability affecting authenticated users with low privileges, creating risk of unauthorized data modification and potential code…. A patch is available.

How to fix or mitigate CVE-2026-45419?

Within 24 hours, audit your DataEase installation to confirm you are not running versions prior to 2.10.23 and identify all users with template management permissions. Within 7 days, implement compensating controls by restricting access to the /de2api/templateManage/save endpoint through network or application-level controls, enable detailed logging of template save operations, and audit existing templates for suspicious Base64 content or directory traversal sequences. Within 30 days, monitor vendor advisories for a patch release to DataEase and prepare immediate deployment plans, or evaluate alternative BI platforms if vendor patch timeline is unacceptable.

DataEase CVE-2026-45419

Q: What is the CVSS score of CVE-2026-45419?

CVE-2026-45419 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44777 HIGH

Path Traversal (CWE-22)

2026-07-15 GitHub_M

Path Traversal Dataease

8.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable API needing only a low-privilege account (PR:L, AC:L); arbitrary file write yields high integrity and availability impact but no data disclosure, so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:02 vuln.today

Analysis Generated

Jul 15, 2026 - 20:02 vuln.today

CVE Published

Jul 15, 2026 - 19:21 cve.org

HIGH 8.5

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing path traversal and arbitrary file writes because only / was used when extracting the file name. This issue is fixed in version 2.10.23.

AnalysisAI

Arbitrary file write in DataEase (open-source BI/data-visualization platform) before 2.10.23 lets an authenticated user (PR:L) abuse the /de2api/templateManage/save template-save endpoint to write attacker-controlled Base64 content to arbitrary filesystem paths. Because StaticResourceServer#saveFilesToServe extracted the filename using only a forward-slash split, crafted staticResource names containing traversal sequences or backslashes escaped the intended static-resource directory. No public exploit or CISA KEV listing is identified at time of analysis, though the fixing commit and advisory are public.

Technical ContextAI

DataEase is a Java/Spring-based open-source data visualization and analytics tool. The flaw lives in the template-management flow: TemplateManageService#save passes user-supplied static resources into StaticResourceServer#saveFilesToServe, which derived the target filename with path.substring(path.lastIndexOf("/") + 1). This CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) root cause meant only the '/' separator was normalized, so backslashes ('\') and traversal-bearing names were not neutralized, letting the effective write path escape the static-resource root. The fix (commit d34f413) introduces extractFileName(), using StringUtils.substringAfterLast(StringUtils.replace(path, "\\", "/"), "/") to normalize backslashes before extracting the basename. Affected CPE is cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* for all versions prior to 2.10.23.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.23, which replaces the naive filename extraction with a backslash-normalizing extractFileName() helper (commit d34f413ef047bd275909d67310d200cbc8ae31ba; release https://github.com/dataease/dataease/releases/tag/v2.10.23; advisory https://github.com/dataease/dataease/security/advisories/GHSA-83fh-fgh3-g9f9). If immediate upgrade is not possible, restrict network access to the /de2api/templateManage/save endpoint (e.g., via reverse-proxy or WAF rules that block traversal sequences such as '../' and encoded backslashes in staticResource names), and tighten which accounts hold template-save privileges since exploitation requires an authenticated low-privilege user - note this reduces but does not eliminate risk from insider or compromised accounts. Additionally run the DataEase process under a least-privilege OS account so an arbitrary write cannot overwrite critical system or web-served files; the trade-off is potential disruption to legitimate template/static-resource uploads while proxy filtering is in place.