CVE-2026-19763: DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal

Severity: low (CVSS 3.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-08-18
Weakness: CWE-22

Description

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

Affected products

DTStack Taier: 1.4.0

References

https://github.com/DTStack/Taier/
https://github.com/DTStack/Taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729
https://github.com/DTStack/Taier/issues/1204
https://github.com/DTStack/Taier/releases/tag/v1.5.0
https://vuldb.com/cve/CVE-2026-19763
https://vuldb.com/submit/868967
https://vuldb.com/vuln/389666
https://vuldb.com/vuln/389666/cti
https://github.com/DTStack/Taier/issues/1204

Get alerted when CVE-2026-19763 or the next vulnerability affects your stack