Description

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T06:16:54.053Z",
  "pubdate": "2026-09-14T06:16:54.053Z",
  "executiveSummary": "A directory traversal vulnerability exists in DataEase versions prior to 1.18.10, stemming from improper input validation within the application's file handling mechanisms.\nThis security flaw allows a remote, unauthenticated attacker to bypass intended directory restrictions, facilitating unauthorized access to sensitive files residing on the host filesystem.\nThe vulnerability resides within the StaticResourceController.java component, which fails to adequately sanitize path traversal sequences (e.g., ../) provided in user-supplied requests.\nBy manipulating request parameters, an attacker can traverse outside the designated web root directory to retrieve arbitrary files, including configuration files, system credentials, or sensitive application data.\nThe risk implication is critical, as successful exploitation results in complete confidentiality compromise of sensitive server-side files, potentially leading to further system-level exploitation or unauthorized data exfiltration.\nExploitation does not require prior authentication, and the vulnerability is directly reachable via network-exposed endpoints, making it highly attractive to remote threat actors.",
  "technicalDetails": "The vulnerability is rooted in an improper implementation of path sanitization within the StaticResourceController.java component in DataEase versions prior to 1.18.10.\nThe application processes requests for static resources by resolving file paths based on input provided by the user. The underlying issue occurs because the application fails to normalize and validate these paths against a restricted directory structure.\nSpecifically, the StaticResourceController.java component does not adequately neutralize directory traversal sequences, such as '../', before passing the user-supplied path to the filesystem API.\nAn attacker can exploit this by crafting an HTTP request containing malicious path sequences, forcing the server to traverse directories outside the intended public web directory. For example, by sending a request such as /static/../../etc/passwd, the attacker attempts to break out of the web root to access sensitive files on the operating system.\nThe attack flow proceeds as follows: First, the attacker identifies a request parameter or URL structure handled by the StaticResourceController.java component that resolves to a local file path. Second, the attacker crafts an HTTP GET request containing traversal sequences designed to escape the web application's root directory. Third, the application's server-side logic processes the input, improperly resolves the path, and maps the request to an arbitrary file on the underlying filesystem. Fourth, the application responds with the contents of the requested, unauthorized file, effectively exposing it to the attacker.\nThe vulnerability is remotely exploitable over the network and does not require authentication or elevated privileges, as the StaticResourceController.java component handles requests independently of session management.\nThe post-exploitation impact includes the potential unauthorized disclosure of configuration files, database credentials, environment variables, source code, or other sensitive system artifacts that can be leveraged to compromise the entire DataEase instance or the underlying host infrastructure."
}