DataEase versions 2.10.20 and earlier have a JDBC parameter blocklist bypass that allows an authenticated user to set the illegalParameters field to an empty list during datasource configuration. This removes the blocklist that normally protects against dangerous JDBC options such as allowLoadLocalInfile=true. When an attacker supplies this option and points the datasource to a malicious MySQL server, the MySQL LOAD DATA LOCAL INFILE protocol can be used to read arbitrary files from the DataEase host, including environment variables and database credentials. The vulnerability is a classic example of improper restriction of operations and is identified as CWE‑183.

The affected product is DataEase, an open‑source data visualization and analytics platform. All releases up to and including 2.10.20 are impacted; the fix was released in version 2.10.21.

The CVSS score of 8.3 indicates high severity and the issue is not listed in CISA's KEV catalog. No EPSS information is available. Exploitation requires an authenticated user with permission to create or modify datasources; the likely attack vector is via the application’s datasource configuration interface. Once the blocklist is bypassed, the attacker can read arbitrary files, exposing sensitive information and potentially further compromising the system.