Remote Code Execution Vulnerability in Dataease Data Analytics Platform
CVE-2025-58748

8.7HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
15 September 2025

What is CVE-2025-58748?

An issue in the Dataease Data Analytics platform allows crafted JDBC configurations to exploit the H2 data source implementation. Specifically, in versions up to 2.10.12, there is a failure to validate that JDBC URLs begin with 'jdbc:h2'. This flaw can enable an attacker to substitute the Amazon Redshift driver and use parameters such as socketFactory and socketFactoryArg to invoke remote XML resources. This can lead to remote code execution, posing a significant security risk. Users are urged to upgrade to version 2.10.13 or later as there are no effective workarounds.

Affected Version(s)

dataease < 2.10.13

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/23a45e72a7abc...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58748 : Remote Code Execution Vulnerability in Dataease Data Analytics Platform