CVE-2026-45533

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.23

Description An issue exists in the bulk delete API endpoint where path traversal sequences, such as ../, can be accepted. This allows attacker-controlled identifiers to be passed to the delete() function within ExportCenterManage, enabling the recursive deletion of arbitrary directories on the server during export task cleanup. Path traversal is a technique used to access files or directories outside the intended folder by using special character sequences.

Recommendations Update to version 2.10.23.