Vulnerability Description
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dataease | Dataease | < 2.10.6 |
Related Weaknesses (CWE)
References
- https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692Not Applicable
- https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjxExploitVendor Advisory
- https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692Not Applicable
FAQ
What is CVE-2025-48998?
CVE-2025-48998 is a vulnerability with a CVSS score of 8.8 (HIGH). DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbit...
How severe is CVE-2025-48998?
CVE-2025-48998 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-48998?
Check the references section above for vendor advisories and patch information. Affected products include: Dataease Dataease.