High severity · published Jul 15, 2026
CVE-2026-50124
DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
7.1
CVSS
0.6%
EPSS
No
On KEV
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
dataease · dataease
< 2.10.23 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50124
github.com
https://github.com/dataease/dataease/commit/304104d70e27a97f8909981f56209edc117dc285
github.com
https://github.com/dataease/dataease/commit/a7bffa795cb0ca041dce0effe68479cf3bf13db1
github.com
https://github.com/dataease/dataease/releases/tag/v2.10.23
github.com
https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v
More from dataease
9.8
CVE-2026-33122
DataEase has SQL Injection via Datasource Management
9.8
CVE-2026-33082
DataEase: SQL Injection in v2 Dataset Export
9.8
CVE-2026-23958
DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
9.8
CVE-2025-64428
DataEase DB2 JNDI Vulnerability
9.8
CVE-2025-64164
DataEase is vulnerable to Oracle JNDI Injection