Remote Code Execution Vulnerability in Dataease Impala Data Source

CVE-2025-58046

What is CVE-2025-58046?

Dataease, an open-source data visualization and analysis platform, is vulnerable to remote code execution in its Impala data source across versions up to and including 2.10.12. This vulnerability arises from inadequate filtering in the getJdbc method of the io.dataease.datasource.type.Impala class, which can be exploited by attackers through carefully crafted JDBC connection strings. These malicious strings may reference remote configuration files, leading to RMI deserialization and unauthorized remote command execution. Users are strongly encouraged to upgrade to version 2.10.13 or later to mitigate this risk, as there are no available workarounds for affected versions.

References