CVE-2025-70829 Information disclosure in n/a

Medium 5.7 Published 17 Feb 2026 Updated 17 Feb 2026

Authenticated attackers can access sensitive data in Datart by exploiting a custom H2 JDBC connection string vulnerability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-70829?

CVE-2025-70829 is a medium-severity vulnerability in n/a, published on 17 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string.

Weakness: CWE-200

Which versions are affected by CVE-2025-70829?

It affects 1 product.

Products include Running-Elephant Datart.

How do I fix CVE-2025-70829?

No fix has been published for CVE-2025-70829 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-70829 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70829 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-m5mm-m787-fp43.