CVE-2025-27138 is a Critical (CVSS 9.8) authentication flaw in the TokenFilter class of DataEase, an open source business intelligence tool, before version 2.10.6. The project fixed it in 2.10.6 and lists no workarounds. Upgrade to 2.10.6 or later. Check access logs afterwards.
What's affected
Affected: DataEase versions up to and including 2.10.5. Fixed: 2.10.6, according to the project's GitHub advisory GHSA-533g-whf8-q637, which lists the Maven package io.dataease.
The advisory says the flaw is in io.dataease.auth.filter.TokenFilter. The filter reads the request path and decides whether it is on a list of addresses that need no login. The matching code cleans the path, but not well enough, and the advisory says there is still a risk of bypass when the product is deployed with server.servlet.context-path set.
The advisory lists no workarounds beyond upgrading.
How to check if you're exposed
Find the version in the DataEase interface, or in the running container or package:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i dataease
If you run it from a jar, look at the file name and the manifest. Anything at 2.10.5 or lower is affected.
Next, find out whether you set a context path. The advisory ties the exposure to deployments that do:
grep -rn "context-path" application*.yml application*.properties 2>/dev/null
If you set a context path, treat the instance as exposed until upgraded. Check access logs for requests that reach API endpoints without carrying a token, and for paths with encoded dot segments.
grep -E "%2e%2e|%2E%2E" access.log | head
What to do now
- Identify all DataEase instances and their versions.
- Upgrade to 2.10.6 or later.
- Check whether the instance uses a context path, since the advisory describes the problem in that setup.
- Put DataEase behind a reverse proxy or VPN that limits who can reach it.
- Review access logs for unauthenticated calls to API endpoints and for paths with encoded dot segments.
- Rotate data source credentials stored in DataEase if you find signs of unauthorised access.
Why it matters
The record lists CWE-287 (improper authentication) and CWE-863 (incorrect authorization). The access decision depended on a string comparison of a request path. If an attacker can write the path so it passes the check but resolves to a protected resource, the check is bypassed.
Path based allow lists are fragile, because different layers can interpret the same URL differently. Here the filter sees one form of the path and the application serves another. A business intelligence tool holds connections to company databases, so unauthorised access can lead to the data behind them. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Prefer access checks that run on the resolved route instead of on raw text, and normalise paths before comparing them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every DataEase install?
The advisory describes the bypass in deployments that set a context path. Because it also says the path filtering was not sufficient, treat any instance at 2.10.5 or lower as affected.
Is there a workaround?
The project lists none. Upgrade to 2.10.6 or later.
Sources
Last reviewed: 19 October 2026.
