CVE-2025-64163 is a critical (CVSS 9.8) server-side request forgery in DataEase, the open source data visualization tool. A blacklist blocked ldap and ldaps but missed the dns protocol. Versions 2.10.14 and below are affected, and version 2.10.15 contains the fix, so plan an upgrade.
What's affected
The NVD record says DataEase versions 2.10.14 and below are affected, and 2.10.15 is the fixed version. The record references the v2.10.15 release and the GitHub advisory GHSA-8397-v66p-539m. We could not retrieve the advisory body, so confirm details there.
Note that DataEase had several related findings around the same time. CVE-2025-64164 (also fixed in 2.10.15) and CVE-2025-64428 (fixed later, in 2.10.17) concern the same family of JNDI and URL handling problems. If you are patching, go straight to 2.10.17 or later, not just 2.10.15.
How to check if you're exposed
Find your DataEase version. For container installs:
docker ps --format '{{.Names}} {{.Image}}'
Otherwise read the version in the application itself or from the release package you installed. Anything at 2.10.14 or below is in scope for this CVE.
Then look at exposure. The CVSS vector shows network reach with no privileges and no user interaction, so an instance reachable from the internet is the main concern. Check which networks the DataEase host can reach internally, because SSRF is dangerous in proportion to what the server can talk to. Review outbound connection logs and DNS logs from the host for lookups or connections you cannot explain.
What to do now
- Upgrade DataEase to 2.10.17 or later. That covers this CVE (fixed in 2.10.15) and the later JNDI fix in CVE-2025-64428.
- Do not expose DataEase to the internet unless you must. Put it behind a VPN or an authenticating proxy.
- Restrict the egress of the DataEase host so it can reach only the data sources it needs.
- Review DNS and outbound connection logs from the host for unexpected destinations.
- Rotate any data source credentials stored in DataEase if you find evidence of misuse.
Why it matters
The record lists CWE-918, server-side request forgery. SSRF means the server can be induced to make requests that the attacker chooses. The maintainers had added a blacklist to filter ldap and ldaps schemes. A blacklist protects only against what its author thought of. The dns scheme was left out, so the filter did not hold.
This is a common pattern. Allow lists, where you name the few protocols and destinations that are valid, age better than block lists. The record does not mark this CVE as known exploited. Still, an unauthenticated critical flaw in a tool that stores database credentials deserves a quick patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why was the blacklist not enough?
It listed ldap and ldaps but not dns, so a different scheme reached the same behavior. The fix in 2.10.15 addresses the gap.
Is 2.10.15 the version to be on?
It fixes this CVE, but later releases fix related issues. Move to 2.10.17 or later.
Sources
Last reviewed: 18 October 2026.
