CVE-2025-48999: Dataease

High severity, CVSS 8.8. EPSS: 10% chance of exploitation in the next 30 days.

DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, `getUrlType()` retrieves `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.

Affected products

• Dataease Dataease: before 2.10.10 (fixed in 2.10.10)

Published 2025-06-03. Last modified 2026-06-17.