CVE-2026-55631: DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55631?
CVE-2026-55631 has a high severity rating of 7.2.
What type of vulnerability is CVE-2026-55631?
CVE-2026-55631 is classified as a Path Traversal vulnerability.
How do I fix CVE-2026-55631?
To fix CVE-2026-55631, upgrade DataEase to version 2.10.24 or later.
What does CVE-2026-55631 allow an attacker to do?
CVE-2026-55631 allows authenticated users to delete arbitrary files on the server.
In which software is CVE-2026-55631 found?
CVE-2026-55631 is found in the DataEase software prior to version 2.10.24.