CVE-2026-24815
Unrestricted File Upload and Deserialization Flaw in datavane tis Before v
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| datavane | tis | to 4.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an unrestricted upload of files with dangerous types and the deserialization of untrusted data in the datavane tis software. Specifically, it is related to the XStream library's XML deserialization process, which lacks proper security restrictions. This allows an attacker to execute remote code by deserializing arbitrary classes through malicious XML input. The issue affects versions of tis before v4.3.0 and is associated with the program files XmlFile.Java. [1]
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution on the affected system, allowing an attacker to run arbitrary code with potentially high privileges. This can result in full system compromise, data theft, data corruption, or disruption of services. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the datavane tis software to version 4.3.0 or later, where the security fix has been applied. The fix restricts the classes that the XStream library can deserialize, preventing exploitation through malicious XML input. Applying this update will prevent remote code execution caused by deserialization of untrusted data. [1]