Which versions of DataEase are affected by CVE-2026-45533?

DataEase versions prior to 2.10.23 contain an arbitrary directory deletion vulnerability affecting authenticated users, enabling malicious or compromised low-privilege accounts to delete critical…. A patch is available.

How to fix or mitigate CVE-2026-45533?

Within 24 hours, audit all DataEase deployments to identify instances running versions prior to 2.10.23; while no public exploit has been identified at time of analysis, the published patch code lowers reverse-engineering barriers and patching should be prioritized. Within 7 days, upgrade all affected instances to version 2.10.23 or later, prioritizing production environments. Within 30 days, implement access controls to restrict export-center functionality to trusted users, enable audit logging for delete operations, and review system logs for any suspicious deletion patterns from the past 90 days.

DataEase CVE-2026-45533

Q: What is the CVSS score of CVE-2026-45533?

CVE-2026-45533 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44781 HIGH

Path Traversal (CWE-22)

2026-07-15 GitHub_M

Path Traversal Dataease

8.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable low-complexity API abuse needing an authenticated account (PR:L); deletion of files outside the app's export directory crosses a security boundary (S:C) with destructive availability impact (A:H) and no confidentiality/integrity read impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:05 vuln.today

Analysis Generated

Jul 15, 2026 - 20:05 vuln.today

CVE Published

Jul 15, 2026 - 19:39 cve.org

HIGH 8.3

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of arbitrary server directories through export task cleanup. This issue is fixed in version 2.10.23.

AnalysisAI

Arbitrary directory deletion in DataEase, an open-source data visualization and analysis platform, allows an authenticated user (PR:L) to abuse the export-center bulk delete API by injecting path traversal sequences (../) into task identifiers, which are passed unsanitized to ExportCenterManage.delete and used to recursively delete server directories. All releases prior to 2.10.23 are affected, and the fix in 2.10.23 constrains deletion to identifiers that exist as legitimate export tasks in the database. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but a full commit-level patch is publicly available which lowers the barrier to reverse-engineering an exploit.

Technical ContextAI

DataEase is a Java/Spring Boot web application (FIT2CLOUD) whose export-center feature persists generated export artifacts under an exportData_path directory keyed by a task id. The vulnerability is a classic CWE-22 Path Traversal / Improper Limitation of a Pathname to a Restricted Directory: the bulk delete endpoint concatenates an attacker-controlled id directly onto exportData_path and calls FileUtils.deleteDirectoryRecursively(exportData_path + id) with no validation that the id maps to a real export task. Supplying ../ segments walks the resolved path outside the intended export storage folder, enabling recursive deletion anywhere the DataEase service account has write access. The CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms the affected product is the DataEase application across all versions below the fixed release.

RemediationAI

Vendor-released patch: upgrade DataEase to version 2.10.23 or later, which adds an existence check (exportTaskMapper.exists) so that FileUtils.deleteDirectoryRecursively and deleteById only run against ids that correspond to a real export task, neutralizing traversal payloads; the release is at https://github.com/dataease/dataease/releases/tag/v2.10.23 and the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-mwr5-hw6p-cqmg. If immediate upgrade is not possible, restrict network access to the DataEase management interface and the export-center delete API to trusted administrators only, tighten authorization so low-privilege accounts cannot reach the bulk delete endpoint (this may disable self-service export cleanup for those users), and run the DataEase service under a least-privilege OS account whose write scope is confined to the export data directory so that traversal outside it fails (side effect: verify the app still has write access to all legitimate paths it needs). Monitor export-center delete requests for id parameters containing ../ or encoded traversal sequences and alert on them as a compensating detection control.