The vulnerability allows an attacker to perform path traversal on Windows systems because the software only filters forward slashes, while Windows uses backslashes. Because of this mismatch, directory components such as '..' can be used in file requests to reference files outside the intended directory. The attack can lead to arbitrary file read, which could expose configuration files, credentials, or other sensitive data, and potentially allow further exploitation if executable files are read.

DataEase, an open‑source data visualization and analysis tool, is affected in all releases prior to version 2.10.23. The issued fix in v2.10.23 removes the path‑traversal logic flaw. Systems running any earlier version on Windows are therefore vulnerable.

The CVSS base score of 8.7 indicates high severity. The EPSS score is not available, but the lack of a workaround and absence from the CISA KEV catalog suggest that exploitation is possible yet not widely observed. Attackers would need to supply a file‑path parameter or otherwise trigger the vulnerable file‑read functionality; no authentication requirement is mentioned. The flaw is exploitable on Windows systems because the server incorrectly accepts backslashes while only sanitizing forward slashes.