The vulnerability resides in the font management module of DataEase. An authenticated user may submit an arbitrary fileTransName when creating a font record; later, when that record is deleted, the backend concatenates the stored value with the font storage directory and passes the result to FileUtils.deleteFile() without sanitizing for path traversal. This flaw permits deletion of any writable file inside the application container and is classified as CWE‑22: Path Traversal.

DataEase, the open‑source data visualization and analysis tool from vendor dataease, is affected in all releases prior to version 2.10.24. The 2.10.24 release and later contain a fix that removes the path traversal vulnerability in the font deletion process.

The CVSS score of 7.2 indicates a medium to high severity risk. Exploitation requires the attacker to have authenticated access to create a font record and then delete that record; the EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that in an environment running DataEase with elevated privileges or storing critical data in the same writable directory, the ability to delete arbitrary files could directly harm application availability and data integrity.