CVE-2026-50124

Deferred Deferred - Pending Action

Code Execution via Zip Protocol in DataEase

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-50124

EUVD

EUVD-2026-44780

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

CVE-2026-50124 is a Remote Code Execution (RCE) vulnerability in DataEase affecting versions before 2.10.23. It allows authenticated attackers to upload a malicious zip file via the Excel upload API, create an H2 datasource using the zip protocol, and execute arbitrary code through SQL queries. The flaw stems from insufficient validation of uploaded files and JDBC blacklist bypasses.

Detection Guidance

Check for unauthorized Excel file uploads via the /datasource/upload API endpoint. Look for suspicious H2 database files with .mv.db extension in server directories. Inspect JDBC datasource configurations for zip protocol usage. Review logs for SQL dataset executions triggering unexpected Java aliases.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server hosting DataEase. If exploited, it could lead to unauthorized access, data theft, system compromise, or disruption of services. Users running vulnerable versions should upgrade immediately to mitigate risks.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later immediately. Block .zip file uploads through the Excel upload API. Review and remove any H2 datasources using zip protocol. Implement strict file extension validation for uploaded files.

Hi! I’m here to help you understand CVE-2026-50124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70