CVE-2026-45419

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.23

Description An issue exists in the template saving process where the /de2api/templateManage/save endpoint, the TemplateManageService#save function, and the StaticResourceServer#saveFilesToServe function do not properly validate the staticResource name and Base64 content. Because only the / character is used when extracting the file name, an attacker can perform path traversal—a technique used to access files and directories that are stored outside the web root folder—leading to arbitrary file writes.

Recommendations Update to version 2.10.23.