CVE-2026-55631

Received Received - Intake

Path Traversal in DataEase Prior to 2.10.24

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-55631

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	to 2.10.24 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. It involves the font management module, where authenticated users can submit an arbitrary fileTransName when creating a font record.

When the font record is deleted, the backend concatenates the stored fileTransName value with the font storage directory and passes it to FileUtils.deleteFile() without sanitizing for path traversal. This allows an attacker to delete arbitrary writable files within the application container.

The issue is fixed in version 2.10.24.

Impact Analysis

This vulnerability can allow an authenticated user to delete arbitrary writable files in the application container.

Such unauthorized file deletions can lead to data loss, disruption of application functionality, and potential denial of service.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade DataEase to version 2.10.24 or later, where the issue has been fixed.

Until the upgrade is applied, restrict authenticated users' permissions to prevent them from creating or deleting font records, as the vulnerability requires authenticated access.

Hi! I’m here to help you understand CVE-2026-55631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70