# CVE-2026-123991: DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload

Status: published. Published: 2026-11-07. Updated: 2026-11-07.

A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist."

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: VulDB) — https://github.com/dataease/dataease/releases/tag/v2.10.28

## Affected products and versions

- n/a / DataEase: 2.10.0 (affected); 2.10.1 (affected); 2.10.2 (affected); 2.10.3 (affected); 2.10.4 (affected); 2.10.5 (affected); 2.10.6 (affected); 2.10.7 (affected); 2.10.8 (affected); 2.10.9 (affected); 2.10.10 (affected); 2.10.11 (affected); 2.10.12 (affected); 2.10.13 (affected); 2.10.14 (affected); 2.10.15 (affected); 2.10.16 (affected); 2.10.17 (affected); 2.10.18 (affected); 2.10.19 (affected); 2.10.20 (affected); 2.10.21 (affected); 2.10.22 (affected); 2.10.23 (affected); 2.10.24 (affected); 2.10.25 (affected); 2.10.26 (affected); 2.10.27 (affected); 2.10.28 (unaffected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P; source: CNA: VulDB

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C; source: CNA: VulDB

- CVSS 3.0: 7.3 (high); CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C; source: CNA: VulDB

- CVSS 2.0: 7.5 (high); AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C; source: CNA: VulDB

- CVSS 4.0: 5.5 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; source: NVD: cna@vuldb.com

- CVSS 2.0: 7.5 (high); AV:N/AC:L/Au:N/C:P/I:P/A:P; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-434, CWE-284

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://vuldb.com/vuln/432070 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/432070/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-123991 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1035491 (CNA: VulDB; third-party-advisory)

- https://github.com/dataease/dataease/releases/tag/v2.10.28 (CNA: VulDB; patch)

- https://github.com/dataease/dataease/releases/tag/v2.10.28 (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-123991 (cna@vuldb.com)

- https://vuldb.com/submit/1035491 (cna@vuldb.com)

- https://vuldb.com/vuln/432070 (cna@vuldb.com)

- https://vuldb.com/vuln/432070/cti (cna@vuldb.com)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-123991; retrieved 2026-11-07; source updated 2026-11-07

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123991; retrieved 2026-11-07; source updated 2026-11-07

Revision: 58cc1714c72c10cde8f2661403ff6a9209d8a774c02dd2fcfcbf6179a121352d

Canonical: https://y2.dev/cve/CVE-2026-123991

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.