Path Traversal in DTStack Taier

Executive Summary

CVE-2026-19763 is a path traversal vulnerability in DTStack Taier 1.4.0. It occurs in the FileUtils.deleteDirectory function of ClusterController.java during cluster creation. The issue allows manipulation of the clusterName argument to perform path traversal, enabling access to files outside intended directories. The vulnerability is triggered when a malicious cluster name containing path traversal sequences like ../ is used to construct a directory path, which is later passed to a file deletion operation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for Taier versions prior to 1.5.0 and inspect cluster names for path traversal sequences like ../ or leading slashes. Review logs for FileUtils.deleteDirectory calls with suspicious paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker to delete arbitrary directories on the system by exploiting path traversal in the clusterName parameter. This could lead to denial of service, data loss, or system instability if the attacker targets critical directories. The impact requires the attacker to have valid operator privileges and the JVM user to have access to the target directories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized directory deletion, potentially leading to data loss or exposure. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Unauthorized deletions could violate these requirements by compromising data availability or confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Taier to version 1.5.0 or later. Validate cluster names to reject path traversal characters. Ensure filesystem paths are derived from non-user-controlled identifiers like clusterId.

Useful 0 Not Useful 0