Input validation error in DataEase - CVE-2026-55633
Published: June 18, 2026
Vulnerability identifier: #VU134828
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55633
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in FontManage#saveFile when handling file uploads. A remote user can upload a specially crafted zip archive disguised with a .ttf extension to execute arbitrary code.
Exploitation requires access to the upload endpoint and relies on the uploaded file being written to disk without content inspection.
Affected software
DataEase
How to mitigate CVE-2026-55633
Install security update from vendor's website.
DataEase - update to 2.10.24