Technical impact
DataEase is an open source data visualization and analysis tool. Prior to version 2.10.23, the application allowed callers to save templates via TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint, using attacker-controlled staticResource names and Base64 content. Because the server extracts the file name by only stripping leading '/' characters and ignores directory traversal indicators, an attacker could write files to arbitrary locations on the host, enabling path traversal and arbitrary file writes. The issue is fixed in version 2.10.23. Authentication requirements are not specified, so the vulnerability may be exploitable by both authenticated and unauthenticated users.
Affected Systems
Vulnerable releases include all DataEase dataease versions prior to 2.10.23. The update tagged v2.10.23 implements proper file name sanitization and blocks traversal attempts, closing the flaw.
Risk and Exploitability
The CVSS score of 8.5 indicates a high severity flaw; however, the EPSS score is below 1%, implying a low current exploitation probability, and the vulnerability is not catalogued by CISA KEV. Attackers who can reach the template save API may exploit the flaw by sending a request with a crafted resource name such as '../../../etc/passwd' and Base64 data, causing the server to write a file wherever the path resolves. Successful exploitation could enable code execution or compromise the system by replacing critical files, hence a security‑critical issue. The likely attack vector is the HTTP API endpoint /de2api/templateManage/save, which must be reachable to the adversary.
