CVE-2026-55631

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24

Description The font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record. When the record is subsequently deleted, the backend concatenates this stored value with the font storage directory and passes it to the deleteFile() function without path traversal sanitization. Path traversal is a technique used to access files and directories that are stored outside the web root folder. This flaw enables the deletion of arbitrary writable files within the application container.

Recommendations Update to version 2.10.24.