The vulnerability stems from the font management module, where an authenticated user can supply an arbitrary file name during font creation and is later deleted; the backend concatenates the stored file name with the font storage directory and passes the result to FileUtils.deleteFile() without sanitizing for path traversal. This writable file within the application container, potentially disrupting services, removing configurations, or deleting application data. The weakness enumerated is CWE‑22: Path Traversal.

All releases of DataEase prior to version 2.10.24 are affected. The issue exists in the open‑source DataEase data visualization and analysis tool and is fixed in the v2.10.24 release.

The CVSS score of 7.2 indicates medium to high severity. The exploit requires authenticated access to create a font record, followed by than 1%, indicating a low but non‑zero exploitation probability. This vulnerability is not listed in the CISA KEV catalog. The potential to arbitrarily delete files makes the risk significant for systems that run the application with elevated privileges or store critical files in the same directory, and it is inferred that such privileged execution would exacerbate the impact.