CVE-2026-40901— DataEase: Quartz Deserialization → Remote Code Execution

DataEase: Quartz Deserialization → Remote Code Execution

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using ObjectInputStream with no deserialization filter or class allowlist. An authenticated attacker who can write to the Quartz job table, such as through the previously described SQL injection in previewSql, can replace a scheduled job's JOB_DATA with a malicious CommonsCollections6 gadget chain payload. When the Quartz cron trigger fires, the payload is deserialized and executes arbitrary commands as root inside the container, achieving full remote code execution. This issue has been fixed in version 2.10.21.

N/A

可信数据的反序列化

DataEase 安全漏洞

DataEase是DataEase开源的一个开源的数据可视化分析工具。用于帮助用户快速分析数据并洞察业务趋势，从而实现业务的改进与优化。 DataEase 2.10.20及之前版本存在安全漏洞，该漏洞源于捆绑的velocity-1.7.jar引入包含InvokerTransformer反序列化小工具链的commons-collections-3.2.1.jar，且Quartz 2.3.2在反序列化作业数据BLOB时未使用反序列化过滤器或类允许列表，经过身份验证的攻击者可通过写入Quartz作业表实现远程代

N/A

N/A