DataEase EUVD-2026-60760

Exploitation requires DataEase to be running on a Windows host, as the vulnerability is directly caused by Windows treating the backslash character as a valid file path separator while the application's sanitization logic exclusively filters the forward-slash. DataEase deployments on Linux or macOS are not vulnerable because the backslash carries no special path meaning on those platforms. The provided CVSS 4.0 vector (PR:N, UI:N, AC:L) indicates no authentication, user interaction, or elevated complexity is required - any network-reachable DataEase instance on Windows is potentially exploitable without credentials. The sole limiting factor that restricts real-world exposure is the Windows-only deployment requirement; defenders should immediately enumerate whether any DataEase instances in their environment run on Windows and treat those as the highest-priority remediation targets.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) describes a network-exploitable, low-complexity, unauthenticated attack yielding high confidentiality impact with no integrity or availability consequence - one of the more severe configurations for a data-exfiltration class flaw. The absence of integrity and availability impact narrows the blast radius to unauthorized file reads, but environments storing database credentials, API keys, or sensitive configuration files on the DataEase Windows host face meaningful exposure. EPSS data is not included in available intelligence, and neither a CISA KEV listing nor public exploit code has been identified at time of analysis, which marginally reduces immediate exploitation risk; however, path separator bypass techniques are well understood and require minimal attacker sophistication to implement. The Windows-only deployment constraint is the dominant real-world risk limiter - DataEase is most commonly deployed on Linux in production environments, and Linux deployments are entirely unaffected. Despite this, even a mid-sized municipal IT team in inowroclaw running DataEase on a Windows application server would face unauthenticated arbitrary file read exposure across the entire server filesystem, making patching the only viable response given the vendor's explicit statement that no workarounds exist. Organizations should audit their DataEase deployment OS before deprioritizing this finding based on CVSS score alone.

An unauthenticated attacker sends an HTTP request to a DataEase file-serving or resource endpoint on a Windows host, embedding ..\ sequences in the path parameter instead of the filtered ../ pattern. The Windows server resolves the backslash as a standard directory separator, traversing outside the web root and returning the contents of an arbitrary file - such as application configuration files containing database credentials or secrets. No public proof-of-concept code has been identified at time of analysis, but the technique is a well-known category of path separator bypass requiring minimal attacker skill to execute manually.