CVE-2025-57772: Dataease H2 JDBC RCE Bypass
Vulnerability summary
CVE-2025-57772 is a critical (CVSS 9.8) Improper Control of Generation of Code vulnerability in dataease. EPSS estimates a 10.89% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 25-08-2025PublishedVulnerability first disclosed.
- 25-08-2025Last modifiedVulnerability information updated.
Description
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
10.89%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
Increase +0.85 pp
From 10.04% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundDataease
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Dataease1 product
- dataease< 2.10.12
1 vendor · 1 product
References
2 links- github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqvX Refsource CONFIRMExploitThird Party Advisory