Which versions of Dataease are affected by EUVD-2026-42090?

DataEase versions prior to 2.10.24 contain a remote code execution vulnerability allowing authenticated users to bypass security hardening and execute arbitrary code on affected servers.. A patch is available.

How to fix or mitigate EUVD-2026-42090?

24 hours: Inventory all DataEase deployments and document current versions; restrict font management privileges to essential administrative accounts; disable FontManage functionality if operationally feasible. 7 days: Implement network segmentation limiting DataEase server access to trusted networks; deploy Web Application Firewall rules blocking .ttf files with embedded ZIP protocol signatures; enable audit logging on file-upload and database-access endpoints. 30 days: Monitor GHSA-8x36-774q-pwqg and DataEase releases for official patch; prepare and test upgrade to version 2.10.24 or later; execute patch deployment with change management controls.

Dataease EUVD-2026-42090

Q: What is the CVSS score of EUVD-2026-42090?

EUVD-2026-42090 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-55633 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-07 GitHub_M

RCE File Upload Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:19 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution. This issue is fixed in version 2.10.24.

AnalysisAI

Remote code execution in DataEase before 2.10.24 allows an authenticated attacker to bypass the prior H2 zip-protocol and file-dropper hardening by uploading a ZIP archive masquerading as a font file (.ttf) via the FontManage.saveFile endpoint, then invoking the H2 database zip protocol against it to execute arbitrary code on the server. The flaw is a regression that defeats an earlier fix, and carries a CVSS 4.0 score of 8.7 (High). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

24 hours: Inventory all DataEase deployments and document current versions; restrict font management privileges to essential administrative accounts; disable FontManage functionality if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.