CVE-2025-32966

Dataease H2 JDBC Connection Remote Code Execution

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.

Affected

dataease

CVSS v4.0 GITHUB

8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.45% chance of exploitation in the next 30 days, 91st percentile

Nuclei

critical · CWE-94

Published

2025-04-23

Proof-of-concept exploits (1)

• dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32966.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/dataease/CVE-2025-32966

References

• CVE Record
• NVD entry