CVE-2026-123991
Deferred Deferred - Pending Action

Authentication Bypass in DataEase via File Upload

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: VulDB

Description
A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-123991
EUVD
EUVD-2026-119317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dataease dataease to 2.10.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A vulnerability in DataEase versions up to 2.10.27 allows unrestricted file uploads due to improper validation in the WhitelistUtils.endsWithAny function. Attackers can remotely exploit this by manipulating file arguments, bypassing authentication checks. The vendor fixed this in version 2.10.28 by enforcing authentication on the upload endpoint.

Detection Guidance

To detect this vulnerability, check if your DataEase instance is running a version prior to 2.10.28. Use commands like 'curl -s http://<target>/version' or inspect the application logs for version details. Verify if unauthorized file uploads are possible through the authentication filter endpoint.

Impact Analysis

This vulnerability could allow attackers to upload malicious files to your system, potentially leading to remote code execution, data theft, or system compromise. Unrestricted uploads may also enable malware distribution or unauthorized access to sensitive resources.

Compliance Impact

The vulnerability allows unrestricted file uploads due to improper authentication and whitelist bypass in DataEase up to 2.10.27. This could lead to unauthorized data access or manipulation, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. The exploit enables remote attacks, increasing compliance risks.

Mitigation Strategies

Upgrade DataEase to version 2.10.28 or later to address the vulnerability. The vendor confirms the issue is resolved by enforcing authentication on the static-resource upload endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...