CVE-2026-45532 DataEase has a Path Traversal Vulnerability
An attacker can exploit a path traversal flaw in DataEase on Windows to read arbitrary files due to insufficient input filtering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45532?
CVE-2026-45532 is a high-severity path traversal vulnerability in dataease, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FILE_SEPARATOR` is `\`, while the server only filters the `/` character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.
Weakness: CWE-22
Which versions are affected by CVE-2026-45532?
How do I fix CVE-2026-45532?
No fix has been published for CVE-2026-45532 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45532 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45532 exists.
Sources
Also known as GHSA-2mqc-w4hm-f3p9.