DataEase EUVD-2026-44777

Requires an authenticated DataEase account with permission to reach the template-save flow (POST /de2api/templateManage/save invoking TemplateManageService#save → StaticResourceServer#saveFilesToServe); this maps to the CVSS PR:L requirement, so it is not exploitable by fully unauthenticated attackers. The attacker must supply a crafted staticResource filename containing path-traversal or backslash characters plus Base64 file content; exploitation works against default configurations of versions prior to 2.10.23 because the vulnerable code only stripped on '/' and never normalized '\'. Limiting factors: valid low-privilege credentials are needed, network reachability to the DataEase API is required, and the target must be running an unpatched version (< 2.10.23) - no user interaction is required.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H, score 8.5) indicates a network-reachable, low-complexity attack requiring only low-level authentication, with high integrity and availability impact and no confidentiality impact - consistent with an arbitrary-file-write primitive rather than data theft. The high subsequent-system impact (SI:H/SA:H) reflects that writing files (e.g., overwriting configuration, dropping a JSP/webshell into a served path) can escalate to broader system compromise. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so real-world exploitation is currently unproven; the primary gating factor is that an attacker must first hold a valid low-privilege account. This is a credible priority for internet-exposed or multi-tenant DataEase deployments given the low complexity and potential RCE pathway, but the PR:L requirement meaningfully limits opportunistic mass exploitation.

An attacker with a low-privilege DataEase account submits a crafted template-save request to /de2api/templateManage/save containing a staticResource name with traversal or backslash sequences and Base64-encoded malicious content. Because the server only split on '/', the file is written outside the static-resource directory - for example dropping a webshell into a servlet-served path or overwriting a configuration file - leading to code execution or integrity compromise. No public POC is identified, but the low attack complexity (AC:L) and network vector make weaponization straightforward once account access is obtained.