CVE-2026-40899: DataEase has an Arbitrary File Read Vulnerability

Vulnerability summary

CVE-2026-40899 is a high (CVSS 8.3) Permissive List of Allowed Inputs vulnerability in dataease. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-04-2026
   PublishedVulnerability first disclosed.
2. 18-04-2026
   Last modifiedVulnerability information updated.

Description

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contains the JDBC security blocklist. When a datasource configuration is submitted as JSON, Jackson deserialization calls setIllegalParameters with an attacker-supplied empty list, replacing the blocklist before getJdbc() validation runs. This allows an authenticated attacker to include dangerous JDBC parameters such as allowLoadLocalInfile=true, and by pointing the datasource at a rogue MySQL server, exploit the LOAD DATA LOCAL INFILE protocol feature to read arbitrary files from the DataEase server filesystem, including sensitive environment variables and database credentials. This issue has been fixed in version 2.10.21.

• CWE-183Permissive List of Allowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.