CyberRota Analysis
AI-GeneratedDataEase versions prior to 2.10.23 on Windows are susceptible to a path traversal vulnerability due to inadequate filtering of file separators, allowing attackers to potentially access unauthorized files. This high-severity flaw (CVSS 8.7) poses a significant risk to users who rely on this data visualization tool for sensitive data analysis. Organizations using affected versions should prioritize upgrading to the latest release to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FILE_SEPARATOR` is `\`, while the server only filters the `/` character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.