---
id: CVE-2026-108824
title: A flaw has been found in DataEase up to 3.0.0
summary: >-
  A flaw has been found in DataEase up to 3.0.0. The impacted element is the
  function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java.
  This manipulation of the argument calculated field causes sql injection. It is
  poss…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-89
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T11:17:10.637'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108824'
references:
  - url: 'https://gist.github.com/k4z01/536b77dfe537e84ca1047c94cc36ef22'
    label: cna@vuldb.com
  - url: 'https://github.com/dataease/dataease/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/dataease/dataease/commit/8509e218e6c1f0080eee9e379f269b2104785ef7
    label: cna@vuldb.com
  - url: 'https://github.com/dataease/dataease/pull/19285'
    label: cna@vuldb.com
  - url: >-
      https://github.com/k4z01/DataEase-Authenticated-SQL-Injection-/blob/main/README.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108824'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/964784'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416600'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416600/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.105Z'
---

## Overview

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.