Unrestricted Upload Vulnerability in DataEase Authentication Filter

CVE-2026-123991

What is CVE-2026-123991?

A vulnerability has been identified in the Authentication Filter of DataEase versions up to 2.10.27 that allows for unrestricted file uploads through improper validation in the WhitelistUtils.endsWithAny function. This flaw can be exploited remotely, enabling malicious actors to upload unauthorized files. The issue stems from a failure to enforce adequate authentication for static-resource uploads, leading to severe security risks. To mitigate this vulnerability, users should upgrade to version 2.10.28, where the vendor has applied fixes to reinforce authentication checks independently of the URI suffix whitelist.

References