CVE-2026-108824: DataEase Utils.java Utils.buildCalcField sql injection
A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Patch 8509e218e6c1f0080eee9e379f269b2104785ef7
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the SQL injection by manipulating the calculated field argument processed by Utils.buildCalcField. No user interaction is required.
Are DataEase deployments on the default version range affected?
DataEase versions up to and including 3.0.0 are identified as affected. The provided information does not describe any configuration prerequisite or mitigation through default settings.
How urgent is remediation?
An exploit has been published and may be used. Apply patch 8509e218e6c1f0080eee9e379f269b2104785ef7 to remediate the issue.