CVE-2025-58045: Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-15 · updated 2026-10-19
Weakness: CWE-918

Description

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). In higher versions of Java, ldap deserialization (autoDeserialize) is disabled by default, preventing remote code execution, but SSRF remains exploitable. Versions up to 2.10.12 are affected. The issue is fixed in version 2.10.13. Updating to 2.10.13 or later is recommended. No known workarounds are documented aside from upgrading.

Affected products

dataease: before 2.10.13 — fixed in 2.10.13

How to fix

Upgrade to a fixed version: dataease 2.10.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-58045 or the next vulnerability affects your stack