CVE-2026-50124 | CyberRota

CyberRota Analysis

AI-Generated

DataEase versions prior to 2.10.23 are vulnerable to arbitrary code execution due to a flaw in the Excel upload API that allows attackers to upload a malicious payload, leading to the execution of precompiled Java aliases. This vulnerability can compromise the integrity and security of systems using DataEase for data visualization and analysis. Organizations utilizing DataEase should prioritize upgrading to version 2.10.23 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals

exploit

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-50124

Severity

HIGH

CVSS

7.1

EPSS

0.32%

Java

Original NVD Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.