CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
Authenticated attackers can delete arbitrary files in the application container via path traversal in the font management module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55631?
CVE-2026-55631 is a high-severity path traversal vulnerability in dataease, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.
Weakness: CWE-22
Which versions are affected by CVE-2026-55631?
How do I fix CVE-2026-55631?
No fix has been published for CVE-2026-55631 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55631 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55631 exists.
Sources
Also known as GHSA-r99p-w8fc-93g6.