DataEase EUVD-2026-44781

Exploitation requires an authenticated DataEase account with access to the export-center bulk delete API endpoint (CVSS PR:L confirms low but non-zero privileges are needed - this is not unauthenticated). The concrete prerequisite is the ability to submit attacker-controlled export task identifiers to ExportCenterManage.delete via the bulk delete API; supplying ../ path traversal sequences in those identifiers is the trigger. Limiting factors: the target must be running a version prior to 2.10.23, the attacker must possess valid credentials/session, and the achievable damage is bounded by the filesystem write permissions of the DataEase service account - a hardened least-privilege deployment confines deletion to the export directory, whereas a service running as root or a broad account allows deletion of arbitrary server directories. No user interaction and no non-default feature toggle is required (UI:N), as export-center deletion is standard functionality.

The vendor CVSS 4.0 base score is 8.3 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact concentrated on availability (VA:H, SA:H) - consistent with a destructive file-deletion primitive rather than data theft, since confidentiality and integrity are rated N. The attack is network-reachable, low-complexity, and requires only low privileges (PR:L: any authenticated DataEase account), with no user interaction, making it readily automatable by an insider or a compromised low-privilege account. No EPSS score, KEV listing, or public POC was provided in the intelligence, so real-world exploitation appears speculative rather than confirmed; however, the availability of a precise upstream commit diff materially raises the practical risk of exploit development. One signal to verify: the official vector scores VI:N (no integrity impact), yet recursive deletion of arbitrary directories arguably also destroys/modifies data - defenders should treat this as a high-severity destructive bug regardless of the integrity sub-score.

An attacker who holds any low-privilege DataEase account (or has hijacked one) sends a crafted bulk delete request to the export-center endpoint with a task identifier such as ../../../../var/lib/dataease, causing the server to recursively delete that directory tree under the service account's privileges. By iterating over sensitive paths the attacker can destroy application data, uploaded assets, or other server files, causing denial of service and data loss. No public POC is referenced, but the patched code path is documented in the fix commit.