CVE-2026-19763

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19763

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19763.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19763

Published

2026-08-14T00:15:08Z

Modified

2026-08-19T09:06:13Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal

Details

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19763.json"
}

References

Affected packages

Git / github.com/dtstack/taier

Affected ranges

Type

GIT

Repo

https://github.com/dtstack/taier

Events

Introduced

726c3569c38ef4340f095d8f4edbd09ca4736c5e

Fixed

ec8c59c76aceb04ab3080543ab2d9c6a4b674729

Fixed

f4e300d7d7925ca56ccd94433197df2a567e0584

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19763.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "54583743082426762956030578269126893767",
            "length": 349
        },
        "id": "CVE-2026-19763-1a390eaa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-common/src/main/java/com/dtstack/taier/common/util/ZipUtil.java",
            "function": "resolveZipEntryFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "232729819750595246656715184787564138956",
            "length": 277
        },
        "id": "CVE-2026-19763-1c2134ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleClusterService.java",
            "function": "addCluster"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "252110588856525027209762828285385381119",
            "length": 461
        },
        "id": "CVE-2026-19763-29a44c55",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "getConn"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "238052077414147473175528123445295522804",
            "length": 827
        },
        "id": "CVE-2026-19763-2e2efe85",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "transHikari"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41615206037729529139621469694446901",
            "length": 349
        },
        "id": "CVE-2026-19763-40915198",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java",
            "function": "getLocalKerberosPath"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "210268226435147891574461985119480790415",
            "length": 657
        },
        "id": "CVE-2026-19763-504e1369",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java",
            "function": "decryptionWithOutExpire"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "178031687960366436386792099211285137179",
            "length": 930
        },
        "id": "CVE-2026-19763-6bcb4058",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java",
            "function": "decryption"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "176400449982846096101802390695556761997",
                "57361077266586914201736469302913092323",
                "336707423814470093847695372590499224110",
                "107268716671079682944193076337668655162",
                "7184990521328322339960019049636744921",
                "245029628264058811057184715392249049787",
                "91190488508155511994862498584936444444",
                "60776415147120303579008511428814799723",
                "167275402350719382388113901262942149770",
                "253762592187505701887500557603559893697",
                "137149389517721966076260074992309028201",
                "310737019609393094223773677982404252188",
                "121026408060005605800235647258346299966"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-7a811deb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleClusterService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287691387672905718375524639337856273048",
            "length": 3168
        },
        "id": "CVE-2026-19763-8212af4b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java",
            "function": "updateComponentKerberosFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "275864901931192623015453266675193674785",
                "94851740730269435422703238219246816015",
                "181497677642151634823746673462705005203",
                "121442291405650256995355857260390870372",
                "151058851383175872364051717010334460903",
                "9207932180491954328625536679407701302",
                "51695025061118893424834441010685588246",
                "215104177409277922443554206401710026128",
                "238765316486295980299037262498703051118",
                "73862851277943086309289309692373940726",
                "91963636966669605390307222390860205135"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-a17c21cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "125207652754199758225664958899669835853",
                "113754164451565641000613584342290843041",
                "141425158978808431014691412966692470833",
                "114363188307720565462939090333811399551",
                "36601068879786074217074935712802022100",
                "133822278915987205917951028871012943291",
                "277953684701032936003686227368651036328",
                "73347492585308774451832137588537897914",
                "211546483702716288425633132004785933916",
                "2638074789996013983460603480420169526",
                "132662104378991811248035567767854969940",
                "93278929754112218543959029082879225429",
                "296845061050133467957579243309393489571",
                "151147890598538299944212756230645561921"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-ab4bdecb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "75976678486532560512579708802654151078",
                "37313998970193933877273769618915037105",
                "200489457005150856165245900089682782537",
                "25991119174527194698080150863409967736",
                "255879685200444006185406463048073397644",
                "5474363699606682211800911024781156195"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-b219fd8b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-common/src/test/java/com/dtstack/taier/common/util/ZipUtilTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "250764809978454954592126176983745784389",
            "length": 352
        },
        "id": "CVE-2026-19763-c52473fb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-common/src/main/java/com/dtstack/taier/datasource/plugin/common/utils/ZipUtil.java",
            "function": "resolveZipEntryFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "66509683111625805662499148178334573483",
                "279537589941028766250420676042234551081",
                "129184063462529431153750033624275728989",
                "166180371275502800268854341234045185223",
                "202602175873262716423556944875794515049",
                "84703034219650018321196437306483079167",
                "26916205891439433460538008963778332557"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-c7319167",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-common/src/main/java/com/dtstack/taier/datasource/plugin/common/utils/ZipUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "93930128593656849880593830323276055513",
                "92240272106574236880109377557111947797",
                "129184063462529431153750033624275728989",
                "166180371275502800268854341234045185223",
                "202602175873262716423556944875794515049",
                "84703034219650018321196437306483079167",
                "26916205891439433460538008963778332557"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-c82201cb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729",
        "target": {
            "file": "taier-common/src/main/java/com/dtstack/taier/common/util/ZipUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "236775718364273575342317746185271799712",
            "length": 756
        },
        "id": "CVE-2026-19763-e85404c2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "getSimpleConn"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35476722405304426314718055141130854298",
                "16973448835063610288451592523618252216",
                "208529561540805787307660125334485094702",
                "233900185467647299823924075632775021527",
                "106116714497235214317126491040361214858",
                "219148540555351613109520622894201884615",
                "97254051285827677200279067890710869194",
                "44995672955429159814180400178989506082",
                "160528109069049956057754407836615276621",
                "119492301685871779104214419493479752856",
                "227958328209535333101371665483180745996",
                "106927720226904905315778844445831734310",
                "91132970460554597457606242107045376336",
                "302170076216052741506721647604372007224",
                "94493790147554251692033773996287882352",
                "111191101673056953953846148935517044768",
                "14831340577830171425188789115927455234",
                "274737605157407583061928697892153883614",
                "281968164159869358151554821808630275726",
                "3423668703749450574163292758860765687",
                "329485612476973805250658545245075752673",
                "255064482410696838331439574146571247252",
                "15655972123580844902986151931643655478",
                "59751113054416544808108457720687475633",
                "122118838471393365148778894450929673690",
                "73966362460831841439477427686330343594",
                "287622994490669714933675734150734508998",
                "232658759576845558036461462343177467376",
                "158973815840826676194590650781040299185",
                "253051636472804511029889529491915326187",
                "225682506161643824595308298676092342009",
                "266060369478870144866320966974863496529",
                "99280198404030792824085209161719429458",
                "14381875794951400378783882723412142605",
                "200889065496396159670761705443025986305",
                "324166437850423912578549953902630697095",
                "132485060053145569814965282497041696471",
                "183967761888338131550302499658054889141",
                "290438919889072939929634167697564493499",
                "217728902571395355879117313241969045991",
                "121832372608264440280495193953948662472",
                "125238076663653029723941085581757147327"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19763-fc5b0ca8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java"
        }
    }
]

vanir_signatures_modified

"2026-08-19T09:06:13Z"