What is CVE-2026-45532?
CVE-2026-45532 is a path traversal vulnerability found in DataEase, an open-source data visualization and analysis tool, affecting versions prior to 2.10.23. The root cause is on Windows systems, where the server only filters the `/` character but fails to filter the `\` character used as `FILE_SEPARATOR` during string truncation. Users should upgrade to version 2.10.23 or later to remediate the issue.
Azərbaycanca: CVE-2026-45532 DataEase açıq mənbəli məlumat vizuallaşdırma alətində aşkar edilmiş path traversal zəifliyidir. Bu boşluq yalnız Windows sistemlərində `FILE_SEPARATOR` olan `\` simvolunun server tərəfindən yalnız `/` simvolu ilə filtrasiya edilməməsi səbəbindən yaranır. DataEase istifadəçiləri dərhal 2.10.23 və ya daha yuxarı versiyaya yeniləməlidirlər.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
On which operating system does CVE-2026-45532 exist?
This path traversal vulnerability occurs only on Windows systems because the server does not filter the `\` character as `FILE_SEPARATOR` like it does for `/`.
To which version should DataEase users upgrade to remediate CVE-2026-45532?
They should upgrade to version 2.10.23 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.