DataEase EUVD-2026-44775

Exploitation requires: (1) a low-privileged authenticated DataEase account (PR:L) capable of creating/configuring a Redshift datasource through io.dataease.datasource.type.Redshift; (2) an attacker-controlled rsjdbc.ini placed in the path returned by System.getProperty("java.io.tmpdir") on the DataEase server; and (3) that rsjdbc.ini setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext to trigger com.amazon.redshift.util.ObjectFactory#instantiate during connect. Limiting factors: it only affects versions prior to 2.10.23, only the Redshift datasource path is vulnerable, the CVSS AC:H/AT:P metrics indicate the attacker must satisfy the tmpdir file-staging precondition (not achievable from a single unauthenticated request), and authentication is required (PR:L), so this is not exploitable against a default, unauthenticated attack surface.

The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, all impacts High, subsequent-system impacts High) scores 9.0 Critical, but the qualitative signals matter more than the number: AC:H and AT:P mean the attack is not trivial or automatable - the attacker must both possess a low-privilege DataEase account able to create a Redshift datasource (PR:L) and stage a malicious rsjdbc.ini in the server's java.io.tmpdir. There is no EPSS value in the input, no KEV listing, and no POC in the references, so this is a real-but-conditional priority rather than a mass-exploitation threat. The all-High confidentiality/integrity/availability and subsequent-system impacts are justified because success yields full server-side code execution. The main uncertainty is how an attacker plants the rsjdbc.ini into tmpdir remotely; if a co-located foothold or a separate file-write primitive is required, real-world exploitability drops further - verify the delivery path with the vendor advisory.

A low-privileged DataEase user who can add data sources plants a crafted rsjdbc.ini in the server's temp directory that sets socketFactory to Spring's FileSystemXmlApplicationContext referencing a malicious bean XML, then configures and tests a Redshift datasource. When DataEase opens the JDBC connection, the Redshift driver instantiates the Spring context via reflection and executes the attacker's code on the server. No public POC is currently identified, and the AC:H/AT:P metrics reflect that the tmpdir file-staging prerequisite makes this non-trivial to automate.