CVE-2025-49002 is a critical flaw (CVSS 9.8) in DataEase. The earlier patch for CVE-2025-32966 blocked two dangerous H2 database settings, but the check could be bypassed by changing letter case. Versions before 2.10.10 are affected. Upgrade to 2.10.10 or later.
What's affected
The CVE record says DataEase versions prior to 2.10.10 are affected, and that it is fixed in 2.10.10. The GitHub advisory lists the Maven package io.dataease with affected versions up to 2.10.8 and a patched version of 2.10.10.
The related earlier issue, CVE-2025-32966, was fixed in 2.10.8 according to its own advisory, which describes it as remote code execution by an authenticated user through the backend JDBC connection. So 2.10.8 is not enough. The 2.10.8 patch is the one this CVE shows to be incomplete.
No workarounds are known.
How to check if you're exposed
Confirm the DataEase version on every instance. For container deployments, list the running image tags:
docker ps --format "{{.Names}} {{.Image}}" | grep -i dataease
Anything below 2.10.10 is in scope, including instances you believed were patched after the earlier advisory. If you manage DataEase through a package or build file, look for the io.dataease artifacts and their versions.
Also review your data sources list. The advisory chain involves a database connection string, so unexpected or recently edited data sources in DataEase are worth a look.
What to do now
- Identify every DataEase instance and its version, starting with any reachable from outside your network.
- Upgrade to 2.10.10 or later. The newest release is a better target, because another advisory in this series names 2.10.11 as a fix.
- Restrict network access to the application while you patch.
- Audit existing data source entries and remove any you do not recognise.
- Rotate credentials stored in DataEase if you find signs of misuse.
Why it matters
The record files this under CWE-290, an authentication bypass by spoofing, although the advisory text is mainly about an incomplete fix. The lesson is a common one. A blocklist that rejects certain strings is fragile, because the same instruction can be written in another form that the list does not match. Case differences are among the oldest ways around such a list.
The advisory shows this issue being combined with the forged token problem in CVE-2025-49001. One flaw gets the attacker past login, and the other turns a database connection setting into a way to run code on the server. Two moderate steps together give a critical outcome. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
I patched CVE-2025-32966 already. Am I safe?
Not necessarily. That fix landed in 2.10.8, and this CVE says the check could be bypassed. You need 2.10.10 or later.
Does a blocklist fix make sense for this kind of bug?
Blocklists are weak against variants such as different letter case. An allowlist of permitted connection settings is a stronger design.
Sources
- DataEase GitHub advisory GHSA-999m-jv2p-5h34
- DataEase GitHub advisory GHSA-h7hj-4j78-cvc7 (CVE-2025-32966)
Last reviewed: 18 October 2026.
