DTStack Taier EUVD-2026-58555

Q: What is the CVSS score of EUVD-2026-58555?

EUVD-2026-58555 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-19761 MEDIUM

Path Traversal (CWE-22)

2026-08-14 cna@vuldb.com

GHSA-5p6w-9cvf-5vx6

Java Path Traversal

5.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-reachable but requires high privileges (PR:H); file write primitive yields low C/I/A - overwriting files could affect availability.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 03:44 vuln.today

Analysis Generated

Aug 14, 2026 - 03:44 vuln.today

DescriptionCVE.org

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

AnalysisAI

Path traversal in DTStack Taier 1.4.0's UploadController allows privileged remote attackers to write files outside the intended upload directory by supplying a crafted filename containing sequences such as '../' or absolute paths. The commit diff confirms that MultipartFile.getOriginalFilename() output was concatenated directly into a filesystem path without any sanitization before the fix. The CVSS 4.0 PR:H rating constrains exploitation to authenticated high-privilege users; no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

DTStack Taier is an open-source, Java-based real-time and offline task development platform. The vulnerable code resides in taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java within the getResourcesFromFiles method. The root cause (CWE-22 - Improper Limitation of a Pathname to a Restricted Directory) is that the filename returned by Spring's MultipartFile.getOriginalFilename() - fully attacker-controlled via the HTTP multipart request - was concatenated with the uploadsDir base path using File.separator and passed directly to new File(path) with no validation. The fix introduces checkAndGetSafeFileName(), which rejects filenames containing '/', '\', '..', or that are absolute paths, and buildUploadFile(), which resolves canonical paths and verifies the destination starts within the upload base directory before writing - a defense-in-depth canonical-path comparison pattern.

RemediationAI

Upgrade to DTStack Taier version 1.5.0, which contains the fix delivered in commit 572773c4315e23e51e30115151cb091749a8d03e; the patched release is available at https://github.com/DTStack/Taier/releases/tag/v1.5.0. If immediate upgrade is not feasible, restrict access to the Upload Controller endpoint at the network or application layer to only the minimum set of required privileged users - reducing exposure directly limits the PR:H exploitation requirement. A WAF rule blocking multipart filenames containing '..', '/', or '\' characters can serve as an additional detective or blocking control, though legitimate filenames are unlikely to contain these sequences and false-positive rates should be low. Monitoring the filesystem for writes outside the configured upload directory provides a detective control. Note that compensating controls do not eliminate the underlying flaw and upgrade remains the definitive remediation.