CVE-2026-45419

Deferred Deferred - Pending Action

Path Traversal in DataEase via Template Save

Publication date: 2026-07-15

Last updated on: 2026-07-18

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing path traversal and arbitrary file writes because only / was used when extracting the file name. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-18

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45419

EUVD

EUVD-2026-44777

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-45419 is an Arbitrary File Write vulnerability in DataEase versions prior to 2.10.23. It allows attackers to write arbitrary files to the server's filesystem by exploiting improper path handling in the TemplateManageService#save method and StaticResourceServer#saveFilesToServe function. Attackers can manipulate staticResource names and Base64-encoded file content to perform path traversal attacks.

Detection Guidance

Check for unauthorized files in system directories, particularly those with suspicious names or paths. Monitor logs for requests to /de2api/templateManage/save with Base64-encoded content. Inspect file writes outside expected directories.

Impact Analysis

This vulnerability can allow attackers to write malicious files to your server, potentially leading to remote code execution, data theft, or system compromise. Attackers could overwrite critical system files, install backdoors, or deploy malware. The impact depends on the server's permissions and the files targeted.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later immediately. If upgrading is not possible, restrict access to the /de2api/templateManage/save endpoint and validate all staticResource inputs to prevent path traversal.

Hi! I’m here to help you understand CVE-2026-45419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70