Which versions of DataEase are affected by CVE-2026-55631?

DataEase data visualization platform (versions before 2.10.24) contains a path traversal vulnerability in font management that allows authenticated users to delete critical application files, risking…. A patch is available.

How to fix or mitigate CVE-2026-55631?

Within 24 hours: Audit all DataEase installations to identify versions before 2.10.24; restrict console access to administrative personnel only; enable detailed audit logging of file operations and user activities. Within 7 days: Contact DataEase maintainers to confirm patch availability; implement network isolation restricting DataEase to internal networks only; review access control lists for DataEase administrative roles. Within 30 days: Upgrade to version 2.10.24 or later upon vendor patch confirmation; implement containerized deployment with restricted filesystem permissions where possible.

DataEase CVE-2026-55631

Q: What is the CVSS score of CVE-2026-55631?

CVE-2026-55631 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42089 HIGH

Path Traversal (CWE-22)

2026-07-07 GitHub_M

Path Traversal Dataease

7.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable module needing only a low-privilege account (PR:L) and no interaction; arbitrary file deletion harms integrity and availability (I:H/A:H) but exposes no data (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:17 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.

AnalysisAI

Arbitrary file deletion in DataEase (open-source data visualization and analytics platform) before 2.10.24 lets authenticated users delete arbitrary writable files inside the application container via a path traversal in the font management module. The stored fileTransName value is concatenated with the font storage directory and passed unsanitized to FileUtils.deleteFile() when a font record is deleted. No public exploit identified at time of analysis; the CVSS 4.0 base score is 7.2 (VI:H/VA:H), reflecting integrity and availability impact without confidentiality loss.

Technical ContextAI

DataEase is a Java/Spring-based open-source BI and data visualization tool. The flaw sits in its font management module: when a user creates a font record they can supply an attacker-controlled fileTransName field, which the backend persists and later, on deletion, concatenates directly onto the configured font storage directory path before calling the internal FileUtils.deleteFile() helper. Because the concatenation performs no canonicalization or traversal filtering, sequences such as '../' escape the intended storage directory. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) issue, where trusted-directory + untrusted-filename string concatenation replaces a properly validated, canonicalized path. The affected CPE is cpe:2.3:a:dataease:dataease covering all versions prior to 2.10.24.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.24, which fixes the path traversal in the font management deletion flow (fix commit 8892a6945b0b7a329a156155270fae58afa895bc). Consult the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-r99p-w8fc-93g6 and download the fixed release from https://github.com/dataease/dataease/releases/tag/v2.10.24. If immediate upgrade is not possible, reduce exposure by restricting who holds authenticated accounts and by limiting access to the font management functionality to trusted administrators only (trade-off: may disrupt legitimate users who manage custom fonts); additionally, run the DataEase container as a non-root user with a least-privilege, read-only filesystem where feasible so that few files are writable and therefore deletable (trade-off: requires validating that legitimate write paths such as upload and temp directories remain functional). These controls narrow the blast radius but do not remove the vulnerability, so patching remains the definitive fix.