CVE-2025-27103

7.3 highEPSS 0.5%

High (7.3) in dataease dataease. EPSS 0.5% chance of exploitation in the next 30 days.

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

Severity

CVSS 4.0

7.3 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-862
Published: 2025-03-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dataease:dataease

References

https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx
https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx

Check your stack JSON