Unrestricted file upload in DataEase Authentication Filter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-434.
Summary
DataEase versions up to and including 2.10.27 contain an unrestricted file upload flaw in the Authentication Filter component, specifically the WhitelistUtils.endsWithAny function (CWE-434). A remote attacker without privileges can upload files. A public exploit is now available and may be used.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist."
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | DataEase | 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27 | 2.10.28 | Patch available | CNA |
- DataEase Vendor— Affected 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27 Fixed in 2.10.28 Patch available CNA
Remediation
Upgrade DataEase to version 2.10.28, which enforces authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA DataEase Fixed in 2.10.28
Timeline
- 2026-11-07 Threatist record created from CVE-2026-123991
- 2026-11-07 Alias added: GHSA-847p-g7jh-6x59
References
Sources
- CVE-2026-123991 · CVE Program
- CVE-2026-123991 · NVD
- GHSA-847p-g7jh-6x59 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences