CVE-2026-45533

UNKNOWN 0.0

DataEase: Path Traversal Vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of arbitrary server directories through export task cleanup. This issue is fixed in version 2.10.23.

CWE	CWE-22
Vendor	dataease
Product	dataease
Published	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for dataease dataease

Be the first to know when new unknown vulnerabilities affecting dataease dataease are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

dataease / dataease

< 2.10.23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dataease/dataease/security/advisories/GHSA-mwr5-hw6p-cqmg github.com: https://github.com/dataease/dataease/commit/dba08037232cf4760fd9e9f36f4bef4e9330d041 github.com: https://github.com/dataease/dataease/releases/tag/v2.10.23