Technical impact
DataEase, an open‑source data visualization and analysis tool, allows an attacker to upload a ZIP file via the /datasource/upload Excel upload API. The ZIP file is used as an H2 datasource that references the zip: protocol. When an SQL dataset path is executed, the CalciteProvider.jdbcFetchResultField method calls statement.executeQuery(), causing precompiled Java aliases stored in test.mv.db to run arbitrary code on the server. This results in a remote code execution vulnerability labeled CWE‑434. The issue is mitigated in version 2.10.23.
Affected Systems
The affected product is DataEase from vendor DataEase. All releases older than version 2.10.23, including 2.10.22 and earlier, contain the flaw. The issue has been fixed in release 2.10.23 and later versions.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity risk. The EPSS score of less than 1% suggests a low probability of exploitation at present, but the vulnerability remains serious given its remote nature and the potential for total system compromise. It is not listed in the CISA KEV catalog. The likely attack vector is remote via the Excel upload API, and the exploit requires the ability to upload a ZIP file and create an H2 datasource with the zip: protocol. Authentication requirements are not explicitly stated, so it is inferred that the attacker must have access to the upload endpoint.
