CVE-2025-48998

7.3 highEPSS 0.5%

High (7.3) in dataease dataease. EPSS 0.5% chance of exploitation in the next 30 days.

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

Severity

CVSS 4.0

7.3 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-862
Published: 2025-06-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dataease:dataease

References

https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692
https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx
https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692

Check your stack JSON