SB2026092474 - Multiple vulnerabilities in DataEase
Published: September 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Unsafe reflection (CVE-ID: N/A)
CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to load arbitrary classes and disclose classpath information.
The vulnerability exists due to unsafe reflection and missing authentication in the SQL Server datasource connection validation interface when processing unauthenticated SQL Server datasource validation requests containing the socketFactoryClass parameter. A remote attacker can send a specially crafted datasource validation request to load arbitrary classes and disclose classpath information.
Class instantiation is attempted only when the targeted class implements javax.net.SocketFactory.
2) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in the getTableFiledSql method of CalciteProvider.java when handling table metadata requests. A remote user can submit a crafted table identifier to disclose sensitive information.
Exploitation requires access to the target datasource and a table whose name contains the crafted identifier.
3) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in CREATE TABLE DDL generation when importing datasets with attacker-controlled column names. A remote user can upload a crafted Excel or CSV datasource with malicious column names to execute arbitrary code.
The embedded H2 engine must be enabled.
4) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or cause a denial of service.
The vulnerability exists due to improper neutralization of special elements in an SQL command in Field2SQLObj.field2sqlObj() when processing a dateFormat parameter in single-datasource queries. A remote user can submit a crafted dateFormat parameter to disclose sensitive information or cause a denial of service.
Exploitation requires dataset or chart editing permissions and a custom date format configuration.
5) Authorization bypass through user-controlled key (CVE-ID: N/A)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify ticket-to-share associations or cause a denial of service.
The vulnerability exists due to improper authorization in the ShareTicketManage.saveTicket ticket-management function when processing ticket update requests. A remote user can submit crafted ticket update data to modify ticket-to-share associations or cause a denial of service.
Exploitation requires obtaining another user's ticket.
Remediation
Install update from vendor's website.
References
- https://github.com/dataease/dataease/security/advisories/GHSA-26fq-m9w8-pxq2
- https://github.com/dataease/dataease/commit/b26005c50
- https://github.com/dataease/dataease/security/advisories/GHSA-xcr3-p567-5c8c
- https://github.com/dataease/dataease/security/advisories/GHSA-64vv-3552-hpcf
- https://github.com/dataease/dataease/security/advisories/GHSA-mjc3-fv7f-qjmv
- https://github.com/dataease/dataease/security/advisories/GHSA-g85v-g7p5-j787