Xxiaolli

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** The font management module allows authenticated users to submit an arbitrary `fileTransName` when creating a font record. When the record is subsequently deleted, the backend concatenates this stored value with the font storage directory and passes it to the `deleteFile()` function without path traversal sanitization. Path traversal is a technique used to access files and directories that are stored outside the web root folder. This flaw enables the deletion of arbitrary writable files within the application container. **Recommendations** Update to version 2.10.24.