CVE-2026-108824: DataEase SQL Injection Vulnerability

CVE-2026-108824 Overview

CVE-2026-108824 is a SQL injection vulnerability affecting DataEase versions up to 3.0.0. The flaw resides in the Utils.buildCalcField function within io/dataease/engine/utils/Utils.java. Attackers can manipulate the calculated field argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires low privileges to abuse. A public exploit has been published, increasing the risk of opportunistic attacks against unpatched installations. The maintainers released a fix in commit 8509e218e6c1f0080eee9e379f269b2104785ef7, and operators are advised to apply the patch.

Critical Impact
Authenticated remote attackers can inject SQL through the calculated field parameter, exposing confidentiality, integrity, and availability of the underlying database to limited compromise. [CWE-74]

Affected Products

DataEase versions up to and including 3.0.0
Component: io/dataease/engine/utils/Utils.java (Utils.buildCalcField function)
Fixed in commit 8509e218e6c1f0080eee9e379f269b2104785ef7

Discovery Timeline

2026-10-12 - CVE-2026-108824 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108824

Vulnerability Analysis

The vulnerability is a classic injection flaw [CWE-74] where unsanitized user-controlled input flows into a dynamically constructed SQL statement. DataEase builds calculated fields from user-supplied expressions passed to Utils.buildCalcField. The function concatenates the attacker-controlled calculated field argument into the generated SQL instead of parameterizing it. An authenticated remote user who can create or modify a dataset view can supply crafted SQL fragments that execute within the backend database context. Public proof-of-concept material and a reproduction README are available on GitHub, lowering the barrier for exploitation against exposed DataEase deployments.

Root Cause

The root cause is improper neutralization of special elements inside the calculated field expression. The buildCalcField logic trusts the incoming expression as a SQL fragment and emits it directly into the query sent to the data source. Because DataEase supports arbitrary SQL expressions for calculated fields by design, enforcement relied on application-layer authorization rather than query parameterization or syntactic validation.

Attack Vector

Exploitation is network-based and requires an authenticated session with permission to create or edit calculated fields on a dataset. The attacker submits a crafted expression containing SQL metacharacters such as subqueries, UNION SELECT, or comment terminators. When the chart or dataset is rendered, DataEase constructs the query via Utils.buildCalcField and executes the attacker payload against the configured data source. The patch rewrites the share interceptor layer to validate share tokens and constrain shared resource access.

java

// Security patch excerpt - LinkInterceptor.java
 package io.dataease.share.interceptor;
 
-import io.dataease.auth.DeLinkPermit;
-import io.dataease.constant.AuthConstant;
-import io.dataease.exception.DEException;
-import io.dataease.utils.ServletUtils;
-import io.dataease.utils.WhitelistUtils;
+import io.dataease.permission.util.TokenUtils;
+import io.dataease.permission.util.V3UserUtil;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
-import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.HandlerInterceptor;

 @Component
 public class LinkInterceptor implements HandlerInterceptor {
+    // Share token validation and resource access constraints added
 }
// Source: DataEase commit 8509e218e6c1f0080eee9e379f269b2104785ef7

Additional patch details are available in the DataEase Commit Update and the DataEase Pull Request #19285. A public proof-of-concept is hosted at GitHub DataEase SQL Injection.

Detection Methods for CVE-2026-108824

Indicators of Compromise

HTTP requests to DataEase dataset or chart APIs containing SQL metacharacters such as UNION SELECT, --, /*, or stacked semicolons inside calculated field parameters.
Backend database logs showing unexpected queries referencing system tables or information_schema originating from the DataEase service account.
Creation or modification of calculated fields by low-privilege DataEase accounts in short time windows.

Detection Strategies

Inspect application logs for calls to Utils.buildCalcField with expressions containing SQL control tokens.
Deploy a web application firewall rule set that flags SQL injection payloads on DataEase endpoints handling dataset and chart configuration.
Correlate authentication events with calculated field changes to identify brute-forced or low-privilege accounts probing the function.

Monitoring Recommendations

Enable verbose query logging on the DataEase backend database and alert on anomalous query shapes from the application user.
Monitor outbound connections from the DataEase host for unexpected egress that could indicate data exfiltration after a successful injection.
Track the DataEase version string in asset inventory to confirm patched builds are deployed.

How to Mitigate CVE-2026-108824

Immediate Actions Required

Upgrade DataEase to the version containing commit 8509e218e6c1f0080eee9e379f269b2104785ef7 or later.
Audit all DataEase user accounts and revoke dataset or calculated field permissions from accounts that do not require them.
Rotate database credentials used by the DataEase service if exploitation is suspected.

Patch Information

The maintainers merged the fix in DataEase Pull Request #19285 with commit 8509e218e6c1f0080eee9e379f269b2104785ef7. The patch tightens share token validation and resource access controls in LinkInterceptor and DeLinkAop. Review the official DataEase Repository and the VulDB CVE-2026-108824 entry for release information.

Workarounds

Restrict network access to the DataEase management interface so only trusted administrative users can reach dataset editing endpoints.
Run DataEase against a database account with least-privilege permissions, limited to the specific schemas and tables required for reporting.
Place a reverse proxy or WAF in front of DataEase with signatures that block common SQL injection payload patterns targeting calculated field parameters.

bash

# Example: pull the patched DataEase source and rebuild
git clone https://github.com/dataease/dataease.git
cd dataease
git checkout 8509e218e6c1f0080eee9e379f269b2104785ef7
# Follow project build instructions to produce patched artifacts