References https://github.com/dataease/dataease/security/advisories/GHSA-hxw4-vpfp-frgv https://github.com/dataease/dataease/security/advisories/GHSA-jc9q-3jfw-mch4 https://github.com/dataease/dataease/security/advisories/GHSA-8wg2-9gwc-5fx2 https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm https://cn-sec.com/archives/4478207.html https://blog.fit2cloud.com/?p=361fddb3-f798-4bb3-88b3-94c312cc9c7e https://cve.imfht.com/detail/CVE-2025-46566 https://www.cnblogs.com/gobybot/p/18912915 https://blog.fit2cloud.com/?p=2134892d-6fb7-4d3d-a4dd-02af05630034 https://ryze-t.com/2024/05/09/Dataease%E6%BC%8F%E6%B4%9E/
Related VulnerabilitiesPoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path TraversalPoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication BypassPoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code ExecutionPoCCVE-2025-49002: DataEase - Remote Code Execution飞致云 Dataease 未授权 设计缺陷漏洞DataEase /de2api/datasource/validate 命令执行漏洞(CVE-2025-62420)飞致云 Dataease 需授权 代码注入漏洞飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞飞致云 DataEase 需授权 代码注入漏洞飞致云 Dataease 需授权 SQL注入漏洞