CVE-2026-45533

Deferred Deferred - Pending Action

Path Traversal in DataEase Export-Center Deletion

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of arbitrary server directories through export task cleanup. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45533

EUVD

EUVD-2026-44781

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-45533 is a Path Traversal vulnerability in DataEase, an open-source data visualization tool. It affects versions before 2.10.23 and allows authenticated users to delete arbitrary server directories by exploiting path traversal sequences like ../ in the bulk delete API endpoint.

Detection Guidance

Check DataEase version with command: curl -s http://<server>/api/version | grep version. If version is below 2.10.23, the system is vulnerable. Monitor for unexpected directory deletions in logs like /var/log/dataease/*.log.

Impact Analysis

This vulnerability can lead to unauthorized deletion of critical server files or directories. Attackers could disrupt services, delete important data, or even compromise system integrity by removing files required for operation. It requires authentication but could cause significant operational and data loss if exploited.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion or system compromise. Loss of data integrity or availability may violate regulatory requirements for data protection and security.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later immediately. Ensure no unauthorized users have access to authenticated endpoints. Review and remove any suspicious export tasks or directories.

Hi! I’m here to help you understand CVE-2026-45533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70