DataEase EUVD-2026-23293

Requires an authenticated DataEase account with permission to create or edit a MySQL datasource configuration (CVSS PR:L). The attacker must submit the datasource as JSON that overwrites the illegalParameters blocklist with an empty list and enable the JDBC parameter allowLoadLocalInfile=true, and must point the datasource at an attacker-controlled (rogue) MySQL server that the DataEase host can reach over the network - the LOAD DATA LOCAL INFILE protocol feature is server-initiated. Limiting factors: valid credentials and datasource-edit privileges are needed (not unauthenticated), the DataEase server must have outbound network reachability to the attacker's MySQL endpoint, and only versions ≤2.10.20 are affected. No end-user interaction is required (UI:N).

Signals are largely consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H, SC:H) indicates a network-reachable, low-complexity attack requiring low-privilege authentication, with high confidentiality impact and a subsequent-system confidentiality impact (reflecting exfiltration of credentials that pivot elsewhere). CISA SSVC aligns: Exploitation=none, Automatable=no, Technical Impact=partial - i.e., no observed exploitation and not trivially scriptable at scale. EPSS is very low at 0.04% (11th percentile), and there is no KEV listing and no known POC, so this is not an urgent mass-exploitation event. The main caveat: exploitation is gated behind valid authentication and the ability to create/edit a datasource, plus attacker control of a rogue MySQL endpoint the DataEase host can reach - meaningful limiting factors. Net: prioritize patching for internet-exposed or multi-tenant DataEase instances (where low-priv accounts are plentiful), but this is not a drop-everything, wormable issue.

A low-privileged authenticated DataEase user stands up a rogue MySQL server they control and creates a new MySQL datasource, submitting JSON that sets illegalParameters to an empty list and includes allowLoadLocalInfile=true in the JDBC connection. When DataEase connects, the malicious server issues LOAD DATA LOCAL INFILE requests to read files like environment variable dumps or database-credential files off the DataEase host, returning them to the attacker. No public POC has been identified, but the vendor advisory documents the full chain.