Which versions of DataEase are affected by CVE-2026-50124?

Authenticated users in DataEase versions before 2.10.23 can execute arbitrary code through datasource uploads, creating risk of data breach and unauthorized system compromise.. A patch is available.

How to fix or mitigate CVE-2026-50124?

Within 24 hours: identify all DataEase deployments and current versions, then restrict datasource upload and creation permissions to trusted administrators only-disable the feature entirely if business operations allow. Within 7 days: if datasource uploads are operationally required, disable H2 database driver support where possible, implement file upload validation and antivirus scanning on archives, and restrict H2 datasource creation via application configuration controls. Within 30 days: deploy continuous monitoring for suspicious datasource configurations and H2 JDBC connection patterns, audit existing datasources for exploitation indicators, establish incident response procedures specific to CVE-2026-50124, and plan DataEase upgrade strategy as vendor patches become available.

DataEase CVE-2026-50124

Q: What is the CVSS score of CVE-2026-50124?

CVE-2026-50124 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44780 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-15 GitHub_M

RCE Java File Upload Dataease

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API, low complexity, requires a low-privilege authenticated account (PR:L), no user interaction, and yields arbitrary code execution giving full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:04 vuln.today

Analysis Generated

Jul 15, 2026 - 20:04 vuln.today

CVE Published

Jul 15, 2026 - 19:38 cve.org

HIGH 7.1

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.

AnalysisAI

Remote authenticated code execution in DataEase before 2.10.23 lets a low-privileged user abuse the Excel/datasource upload workflow to run arbitrary Java. By uploading a crafted payload.zip via /datasource/upload and defining an H2 datasource that references the archive through the zip: protocol, an attacker forces CalciteProvider.jdbcFetchResultField to execute a query that triggers precompiled Java aliases embedded in test.mv.db. The vendor CVSS 4.0 vector scores this 7.1 (confidentiality-only), but the underlying primitive is full arbitrary code execution; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (Java/Spring backend, io.dataease packages) that connects heterogeneous datasources and runs SQL datasets through an Apache Calcite abstraction layer. The root cause is CWE-434 (unrestricted upload of a dangerous file type) chained into a JDBC-side code-execution sink: the H2 database engine supports aliases/user-defined functions that can carry precompiled Java, and H2's zip:/split file protocols allow a database file (here test.mv.db) to be sourced from an attacker-supplied archive. Because CalciteProvider builds the connection from user-controlled datasource configuration and then calls statement.executeQuery() (CalciteProvider.jdbcFetchResultField), the malicious aliases in the uploaded H2 file are invoked during normal query fetch, turning a data-source definition into a code-execution channel. CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms all versions prior to the fix are in scope.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.23 or later, which introduces JdbcUrlSecurityPolicy and driver-class validation (commits 304104d70e27a97f8909981f56209edc117dc285 and a7bffa795cb0ca041dce0effe68479cf3bf13db1) to constrain which drivers and JDBC URLs a datasource may use; follow the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v. If immediate upgrade is not possible, apply compensating controls: restrict or disable the /datasource/upload endpoint and the ability to create H2 datasources for non-administrative roles, reject datasource configurations whose JDBC URL uses the zip:/split: file protocols, and remove low-privileged users' ability to create arbitrary datasources. Also keep DataEase behind authenticated network segmentation so the console is not internet-exposed. Trade-offs: disabling H2/custom datasource creation breaks legitimate H2-based or file-upload data workflows, and tightening upload permissions may require reassigning who manages datasources, so validate business impact before enforcing.