DataEase is an open‑source data visualization and analysis tool that has a path traversal flaw in its export‑center deletion functionality. Prior to version 2.10.23, the bulk delete API accepts sequences such as "../" and forwards attacker‑controlled identifiers to ExportCenterManage.delete, enabling recursive removal of arbitrary server directories during export task cleanup. This defect can lead to data loss, service disruption, and the exposure of sensitive information. The weakness is classified as CWE‑22, Path Traversal. This issue is fixed in version 2.10.23.

All DataEase installations running a version earlier than 2.10.23 are affected.

The vulnerability carries a CVSS score of 8.3, indicating high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted bulk delete request. Based on the description, the likely attack vector involves interacting with the bulk delete API, potentially necessitating authentication or privileged user access. Once triggered, the attacker can delete entire directories, compromising the integrity and availability of the system.