DataEase EUVD-2026-101555

Exploitation requires an authenticated DataEase account (CVSS PR:L - any low-privileged user, not necessarily admin) and the ability to create or edit a dataset group-field binning definition, where the attacker supplies crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values. Because this is stored/second-order SQL injection, the payload only executes when a chart that uses the affected field is rendered, so exploitation is gated by (1) having a valid account with dataset-editing capability and (2) the tainted field subsequently being queried by a chart. It affects DataEase versions prior to 2.10.26 and no non-default configuration is indicated - the vulnerable Utils.transGroupFieldToSql code path is standard. The main limiting factor is the required authentication; there is no user-interaction requirement from a victim (UI:N).

This is a genuine, actionable priority for environments running DataEase, though not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) - i.e., any authenticated user account, no admin rights - with full VC:H/VI:H/VA:H impact to the backend database, yielding the 8.7 High score. The source-code evidence (the patch adds Utils.validateSqlInjectionRisk() calls around FieldGroupDTO min/max/startTime/endTime) independently confirms the root cause is unvalidated free-form values flowing into generated CASE expressions, matching CWE-89. Signals are consistent rather than conflicting: a network vector with low privilege and high technical impact is plausible for a stored SQLi reached through normal dataset/chart functionality. The limiting factor is authentication (PR:L) and the stored/second-order nature - the payload only executes when a chart renders the affected field - which reduces the drive-by, fully-unauthenticated risk that would justify the highest urgency. No CISA KEV listing and no EPSS score were provided in the input, and no public exploit is referenced, so there is currently no evidence of widespread automated exploitation; absence of these feeds is a data gap, not proof of low risk. Net: patch promptly where DataEase is internet-exposed or multi-tenant, since any logged-in user can fully compromise the configured backend database.

An attacker with any low-privileged DataEase account creates or edits a dataset group-field binning definition and injects malicious SQL into the FieldGroupDTO min, max, startTime, or endTime values. Utils.transGroupFieldToSql embeds these unvalidated strings into a CASE expression, and when any chart uses that field the tainted SQL reaches unparameterized execution against the backend database, allowing data theft, modification, or destruction. No public proof-of-concept is referenced in the provided data, so exploitation currently requires manual crafting of the payload.