Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55631DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management

High 7.2

In plain English

A high-severity path traversal in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.24

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-r99p-w8fc-93g6 x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/8892a6945b0b7a329a156155270fae58afa895bc x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.24 x_refsource_MISC