CVE-2026-50124: DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50124?
The severity of CVE-2026-50124 is rated at 83, indicating a high risk associated with the vulnerability.
How can I fix CVE-2026-50124?
The vulnerability can be mitigated by upgrading DataEase to version 2.10.23 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-50124?
CVE-2026-50124 is classified as a Remote Code Execution (RCE) vulnerability due to malicious file upload via the zip protocol.
When was CVE-2026-50124 published?
CVE-2026-50124 was published on July 15, 2026.
What is the impact of exploiting CVE-2026-50124?
Exploiting CVE-2026-50124 allows an attacker to execute arbitrary code on the server by uploading a specially crafted payload through the upload API.