Arbitrary file upload in Dataease

CVE-2026-55633

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontMa…

Vulnerability class: Unrestricted File Upload

Affected products

Dataease — versions < 2.10.24

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)