CVE-2025-62421: DataEase vulnerable to stored cross-site scripting via file upload bypass
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist. If the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks. This allows an attacker to access "upload/1.js" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript. The vulnerability is fixed in version 2.10.14. No known workarounds exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62421?
CVE-2025-62421 has been classified as a medium severity vulnerability due to its potential impact on user data security.
How do I fix CVE-2025-62421?
To fix CVE-2025-62421, upgrade to DataEase version 2.10.14 or later which addresses the stored cross-site scripting vulnerability.
What impact does CVE-2025-62421 have on my DataEase application?
CVE-2025-62421 allows attackers to exploit stored cross-site scripting through improper file upload validation, potentially compromising user sessions and data.
Is my version of DataEase vulnerable to CVE-2025-62421?
If you are using DataEase version 2.10.13 or earlier, your application is vulnerable to CVE-2025-62421.
What types of attacks can be carried out using CVE-2025-62421?
CVE-2025-62421 can be exploited for stored cross-site scripting attacks, leading to unauthorized actions on behalf of users who access the compromised application.