Which versions of Dataease are affected by CVE-2026-55633?

DataEase versions prior to 2.10.24 contain a remote code execution vulnerability allowing authenticated users to bypass security hardening and execute arbitrary code on affected servers.. A patch is available.

How to fix or mitigate CVE-2026-55633?

24 hours: Inventory all DataEase deployments and document current versions; restrict font management privileges to essential administrative accounts; disable FontManage functionality if operationally feasible. 7 days: Implement network segmentation limiting DataEase server access to trusted networks; deploy Web Application Firewall rules blocking .ttf files with embedded ZIP protocol signatures; enable audit logging on file-upload and database-access endpoints. 30 days: Monitor GHSA-8x36-774q-pwqg and DataEase releases for official patch; prepare and test upgrade to version 2.10.24 or later; execute patch deployment with change management controls.

Dataease CVE-2026-55633

Q: What is the CVSS score of CVE-2026-55633?

CVE-2026-55633 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42090 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-07 GitHub_M

RCE File Upload Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:19 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution. This issue is fixed in version 2.10.24.

AnalysisAI

Remote code execution in DataEase before 2.10.24 allows an authenticated attacker to bypass the prior H2 zip-protocol and file-dropper hardening by uploading a ZIP archive masquerading as a font file (.ttf) via the FontManage.saveFile endpoint, then invoking the H2 database zip protocol against it to execute arbitrary code on the server. The flaw is a regression that defeats an earlier fix, and carries a CVSS 4.0 score of 8.7 (High). No public exploit has been identified at time of analysis, but the vendor GitHub Security Advisory (GHSA-8x36-774q-pwqg) and two remediation commits are published.