CVE-2026-50124CWE-434

DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper

High · published July 15, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-15T19:38Z
EPSS history
Timeline
  • 15 JUL 19:38Z
    DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
    cvelistv5