Dataease, an open source data visualization tool, has a critical flaw that allows an attacker to manipulate the IniFile parameter in a JDBC connection. This manipulation forces the Redshift JDBC driver to load an attacker‑controlled configuration file, which can inject dangerous JDBC properties. The result is remote code execution on the host running Dataease. The weakness is identified as CWE‑22 (Path Traversal). The vulnerability permits an attacker to execute arbitrary code with the privileges of the Dataease process, potentially compromising the entire system and data exposed by the tool.

All installations of Dataease with the Redshift JDBC driver that are running a version prior to 2.10.20 are affected. The cpe string for the product is cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* and the specific version range is any version older than 2.10.20. The issue was fixed in release 2.10.20.

The CVSS v3.1 score for this issue is 9.3, indicating Critical risk. The EPSS score is less than 1%, suggesting a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a JDBC connection string that specifies an arbitrary configuration file; the attack surface is therefore likely limited to environments where users can control or influence JDBC URLs or data source configurations. Successful exploitation would allow arbitrary code execution with the application’s runtime privileges.