CVE-2025-49003: Critical Unicode Bypass in DataEase

CVE-2025-49003 is a critical flaw (CVSS 9.8) in DataEase. A filter can be bypassed because Java turns two special letters into plain I and S when converting to uppercase, which the record says can lead to remote code execution. Fixed in 2.10.11, with no workaround.

What's affected

The CVE record says DataEase versions prior to 2.10.11 are affected. The GitHub advisory lists the Maven package io.dataease with affected versions up to 2.10.8 and a patched version of 2.10.11. Treat anything below 2.10.11 as vulnerable.

This is the third DataEase flaw in a short run. The earlier fixes in 2.10.8 and 2.10.10 do not cover it, so being on 2.10.10 is not enough. The advisory says no known workarounds are available.

How to check if you're exposed

Find the version of each DataEase instance. For containers, list running image tags:

docker ps --format "{{.Names}} {{.Image}}" | grep -i dataease

If the tag is below 2.10.11, you are in the affected range. Also check where the service listens. The CVSS vector in the record lists a network attack vector, low complexity and no privileges required, so a copy exposed to the internet deserves the fastest attention.

For software that bundles DataEase, check whether the vendor has shipped an updated build, and ask them which DataEase version it contains.

What to do now

1. Inventory all DataEase deployments and record their versions.
2. Upgrade to 2.10.11 or later.
3. Until you can, limit access with a VPN or an IP allow list.
4. Review data source entries for connection settings you do not recognise.
5. Rotate stored database credentials if the instance was reachable from outside and you see anything suspicious.

Why it matters

The record files this as CWE-153, improper neutralization of substitution characters. The idea is simple. A program checks input against a list of forbidden words after changing letter case, but the case conversion itself can change what the text means. In Java, the dotless lowercase i and the long s become I and S when uppercased, so a word the filter forbids can be written in a form that passes the check and then turns back into the forbidden word.

The general lesson applies far beyond this product. Validate after normalising, not before, and prefer allowlists over blocklists. Case conversion that is not tied to a fixed locale or character set is a recurring source of security bugs. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation in the wild.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• DataEase GitHub advisory GHSA-x97w-69ff-r55q

Last reviewed: 18 October 2026.