CVE-2026-53729
- Source
- https://cve.org/CVERecord?id=CVE-2026-53729
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53729.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53729
- Aliases
-
- GHSA-9423-78gr-xjj5
- Published
- 2026-07-07T20:23:08Z
- Modified
- 2026-08-12T16:41:09Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- DataEase ExportCenter IDOR allows cross-user export task access
- Details
-
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53729.json" }- References
-
- https://github.com/dataease/dataease/releases/tag/v2.10.24
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53729.json
- https://github.com/dataease/dataease/security/advisories/GHSA-9423-78gr-xjj5
- https://nvd.nist.gov/vuln/detail/CVE-2026-53729
- https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b
Affected packages
Git / github.com/dataease/dataease
Affected versions
v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.23
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53729.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "169173322147835513551862823390184388579",
"length": 454
},
"id": "CVE-2026-53729-0c8369df",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "deleteTask"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"274753048184955018277428187694039216879",
"156538359047531764818988485298978090774",
"115095623261719411874786638326504157350",
"121387547099686079026032619326541301436",
"221493756039543088187211181824629663634",
"131146791832275181197620172945006344088",
"51551341456356990837967839030398703006",
"55405352666016835715314348186846216323",
"145656970534697405926253958063866251223",
"246287932547059068162964807124557184603",
"336093538004706478161212073945546735336",
"184450589340638828614160695518497718466",
"7350001354614640945034289940619059844",
"22228349675700443332728534371766461101",
"234076871446705610357119410873677806296",
"67746878512435932426754818570302673661",
"81831315588826091630079953611272188220",
"32969590400353726037600922436166975413",
"198127707859521760285808965951606147940",
"224994058951052107176446636369982274210",
"292831610406530240077625363616049520484",
"95007857152279816487369635798640132382",
"93090648803179078268163360215444125345",
"248062707284340868454107052309164774837",
"19837551494571244319893727697117363068",
"275737980145764789587682648588341015493",
"215999545263714615547082993661699456217",
"199353245767804997766177360999965863341",
"168696545729758373578913592875082964014",
"252057451184369828987574690780473531229",
"93116822742602721179381428962527499114",
"152089314009496578187583930411978750786",
"277416292014268306647732910911591817705",
"313073898947495931838032336713646739966",
"309375562389354581891680400723096938876",
"85128352897978082347532030838465492599",
"131841770713497826576431647000635720120",
"94547409338767548240895474349786165919",
"39272071776378563768104687819440765923",
"261159571482519367053458839561990557416",
"208544385643249711311119189702678316210",
"926859895532241238017725578333926142",
"39946921725665012825868720546159800618",
"5711931764620668016170286026088214905",
"109166452808120608784114344445974250134",
"185525594676239463511895541190058415944",
"30610260198905961010899613628314677647",
"159508125098543682415795951274350889914",
"58187439195347350729911258622306421482",
"202726547597068959557288431408291832262",
"284556514826703700146290792396041908945",
"111137217991427813369039190586340136449"
],
"threshold": 0.9
},
"id": "CVE-2026-53729-0d267695",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "77494538332632384185313209746676832142",
"length": 176
},
"id": "CVE-2026-53729-149c73de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "download"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291261716119694906855914551258304632578",
"length": 159
},
"id": "CVE-2026-53729-1e669da5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java",
"function": "visitFile"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "86927137884523794216972286519054909136",
"length": 720
},
"id": "CVE-2026-53729-23c04f43",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java",
"function": "deleteDirectoryRecursivelyInternal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218719327378696050010667827170917452204",
"length": 452
},
"id": "CVE-2026-53729-3147e289",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java",
"function": "deleteDirectoryRecursively"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "48185264178374384805392828975473308273",
"length": 524
},
"id": "CVE-2026-53729-353ddec4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "generateDownloadUri"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"47685655835596645253263512462856285799",
"41080620963100354093348097431808083793",
"242837343933144194152273132402809534611",
"120190954927914815036413700349071479966",
"35508524470575428537868354938758401560",
"28462081331622119556809142053322720995",
"119453388931644461494948364476840677692",
"22020503104504027384248616624258862998",
"84967234788428059516864905653764611407",
"139432164571792421298214821938967242244",
"310970107599547911716646971468337486334",
"125287199241712856651447349960268783828",
"313699604163959744931316628134800850170",
"112720928393655702440049410079760177249",
"300655775385556712813105116041361227737",
"199852850955267850216886936944411908693",
"267590060084084217786398251313108920",
"334468702962322465161457702659470248124",
"269759468228760616104035861612658834255",
"335643708549065132981211073189418281392",
"121932378231304096213039001864137133850",
"220089277784738148133874718160628386651",
"57568017704879043119771472492457044704",
"150834076559438088304817165556460342460",
"202573678339962908958212054019152457315",
"34412983174383143121623632724740004553",
"220874395861016280571407197092758874945",
"297083566492562235011715046298725020438",
"62988741503888861328903124552412340098",
"276009097490672090516387081222533175120",
"258144042977087978617765205819375690542",
"18562359456361493522322260081358287747",
"316702293786837169639933811537198655908",
"295601526394921442906325029352135885373",
"290835515935709159705138859189435544658",
"96864710023441411212796377116286675804",
"10045697690772450950196026713512760521",
"106190487285130536492153521732448413820",
"189972573694241124190741748887280689485",
"314451684548100926938747129390624825111",
"264225851063772169846811288717551922983",
"104458482277961483395936466895187735746",
"168697656427876414980072708024135981395",
"46525702296873265881279349181912897580",
"201474933980872130965749559663100334320",
"284841928567863797285426564467208933900",
"167474262863374705287208161241772311588",
"330659957760822371578945959007429715289",
"63717661836184164533348286516419036166",
"292158815698030288632560167853401380328",
"25130932322063347222652969935391570038",
"172793133474424329611734356150160287940",
"13680093913829282585466132749178998646",
"289204551768028525132737197029019907474",
"299502649672851610447836419933816955360",
"268133536189628835869275448185350479024"
],
"threshold": 0.9
},
"id": "CVE-2026-53729-3a955314",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "129469150870686529382273919103104574358",
"length": 192
},
"id": "CVE-2026-53729-5923aa42",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java",
"function": "postVisitDirectory"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201584676915560639977829237898949881403",
"length": 339
},
"id": "CVE-2026-53729-7756976c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "resolveExportTaskDirectory"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323088270217614882363074791857352112090",
"length": 86
},
"id": "CVE-2026-53729-8046d2e0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236070961268574398789316056297290571089",
"length": 190
},
"id": "CVE-2026-53729-82a3ece9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "sdk/common/src/main/java/io/dataease/utils/FileUtils.java",
"function": "validateChildPath"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119710300688150146569311153264854700410",
"length": 942
},
"id": "CVE-2026-53729-bbf85db4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java",
"function": "retry"
}
}
]
vanir_signatures_modified
"2026-08-12T16:41:09Z"