Vulnerability · Published Oct 12, 2026 · Assigned by VulDB

CVE-2026-108824DataEase Utils.java Utils.buildCalcField sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in DataEase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
n/a	DataEase	3.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-416600 | DataEase Utils.java Utils.buildCalcField sql injection vdb-entry, technical-description
VDB-416600 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-108824 | CVE Analysis and Report third-party-advisory
Submit #964784 | DataEase <= 3.0.0 (main, unfixed) SQL Injection third-party-advisory
https://gist.github.com/k4z01/536b77dfe537e84ca1047c94cc36ef22 exploit
https://github.com/dataease/dataease/pull/19285 issue-tracking, patch
https://github.com/dataease/dataease/commit/8509e218e6c1f0080eee9e379f269b2104785ef7 patch
https://github.com/k4z01/DataEase-Authenticated-SQL-Injection-/blob/main/README.md related
https://github.com/dataease/dataease/ product