CVE-2026-40899 - Vulnerability Analysis

Overview

DataEase <= 2.10.20 contains a file system read vulnerability caused by a JDBC parameter blocklist bypass via Jackson deserialization of the illegalParameters field, letting authenticated attackers read arbitrary files by exploiting LOAD DATA LOCAL INFILE, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can read arbitrary files on the server, exposing sensitive data like environment variables and database credentials.

Mitigation

Upgrade to version 2.10.21 or later.

References

• https://github.com/dataease/dataease/releases/tag/v2.10.21
• https://github.com/dataease/dataease/security/advisories/GHSA-944x-93jf-h3rx

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner