References https://nvd.nist.gov/vuln/detail/CVE-2025-49001 https://github.com/dataease/dataease/security/advisories/GHSA-xx2m-gmwg-mf3r https://cve.imfht.com/detail/CVE-2025-49001?lang=en https://blog.csdn.net/weixin_45519417/article/details/151222774 https://developer.cloud.tencent.com/article/2565137 https://cve.imfht.com/poc_detail/f3b4f3a6c1bab3c4c9ec27020f41f01948749a84 https://www.knowsafe.com/ti/info/0/997038 https://cloud.tencent.com/developer/article/2565137 https://avd.aliyun.com/product?prod=dataease&page=-24 https://www.sentinelone.com/vulnerability-database/cve-2025-49001/
Related VulnerabilitiesPoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path TraversalPoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication BypassPoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code ExecutionPoCCVE-2025-49002: DataEase - Remote Code Execution飞致云 Dataease 未授权 设计缺陷漏洞DataEase /de2api/datasource/validate 命令执行漏洞(CVE-2025-62420)飞致云 Dataease 需授权 代码注入漏洞飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞飞致云 DataEase 需授权 代码注入漏洞飞致云 Dataease 需授权 SQL注入漏洞