What’s Vulnerable › Vulnerabilities

CVE-2026-50124: DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-15 · updated 2026-07-17
• Weakness: CWE-434

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.

Affected products

• dataease: before 2.10.23

References

• https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285
• https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1
• https://github.com/dataease/dataease/releases/tag/v2.10.23
• https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v
• https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v

Get alerted when CVE-2026-50124 or the next vulnerability affects your stack