DataEase v2.10.24 Vulnerability Patch: RCE, SQLi, XSS, IDOR, Path Traversal Fixes

Vulnerability Overview The web page screenshot displays the vulnerability remediation information for version v2.10.24 of the project. It primarily involves the remediation of multiple security vulnerabilities, including shared password issues, unauthorized access, data export center flaws, IDOR vulnerabilities, SQL injection, and XSS vulnerabilities. Impact Scope Shared Password: Vulnerability where links prior to verification would leak issues (CVE-2026-50529) Unauthorized Access: Vulnerability allowing unauthorized data retrieval (CVE-2026-50530) Data Export Center: IDOR vulnerability present (CVE-2026-53729) Preview SQL Interface: Vulnerability allowing unauthorized access to data sources (CVE-2026-53730) Font Management Path Traversal: Vulnerability leading to arbitrary file deletion (CVE-2026-55631) Font File Upload Interface: Vulnerability allowing remote code execution via Zip files (CVE-2026-55633) H2 JDBC RCE Bypass: Vulnerability (CVE-2026-53751) Chart Searcher: Authenticated SQL injection vulnerability present (CVE-2026-55635) Dashboard Text Component: XSS vulnerability present (CVE-2026-55647) symmetricKey Interface: Issue where symmetric keys were publicly returned via a whitelist Path Traversal: Vulnerability Sensitive Information Leakage: Vulnerability Data Source Metadata SQL: Injection vulnerability present Remote Excel Data Source: Password leakage vulnerability present CalciteProvider: SQL injection vulnerability present ExcelWatermarkUtils: Resource injection vulnerability present DataEase Static Resource Base64 Interface: File reading vulnerability present XSS Vulnerability Caused by v-html Content-Security-Policy: Security headers Remediation Shared Password: Remediated the issue where links prior to verification would leak Unauthorized Access: Remediated the vulnerability allowing unauthorized data retrieval Data Export Center: Remediated the IDOR vulnerability present Preview SQL Interface: Remediated the vulnerability allowing unauthorized access to data sources Font Management Path Traversal: Remediated the vulnerability leading to arbitrary file deletion Font File Upload Interface: Remediated the vulnerability allowing remote code execution via Zip files H2 JDBC RCE Bypass: Remediated the vulnerability Chart Searcher: Remediated the authenticated SQL injection vulnerability present Dashboard Text Component: Remediated the XSS vulnerability present symmetricKey Interface: Remediated the issue where symmetric keys were publicly returned via a whitelist Path Traversal: Remediated the vulnerability Sensitive Information Leakage: Remediated the vulnerability Data Source Metadata SQL: Remediated the injection vulnerability present Remote Excel Data Source: Remediated the password leakage vulnerability present CalciteProvider: Remediated the SQL injection vulnerability present ExcelWatermarkUtils: Remediated the resource injection vulnerability present DataEase Static Resource Base64 Interface: Remediated the file reading vulnerability present XSS Vulnerability Caused by v-html: Remediated Content-Security-Policy: Added security headers POC Code or Exploit Code The page does not contain specific POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

DataEase v2.10.24 Vulnerability Patch: RCE, SQLi, XSS, IDOR, Path Traversal Fixes

More from this source