CVE-2025-57772

Dataease H2 JDBC RCE Bypass

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 2.10.12.

CVSS 3.19.8Critical EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix2.10.12Upgrade to this build

Published 2025-08-25Updated 2025-09-03Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

DataeaseAffected: < 2.10.12Upgrade to: 2.10.12Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of DataEase you are running — anything before 2.10.12 is vulnerable.
If you manage this yourself, upgrade DataEase to version 2.10.12 or later as soon as possible.
If a vendor or IT provider hosts DataEase for you, ask them directly whether your instance has been patched.
Restrict network access to your DataEase instance (e.g., firewall, VPN-only access) until the upgrade is confirmed.
After upgrading, review DataEase logs for unusual database connection attempts made before the patch.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.

In plain language

Written by AI from the record

A serious flaw in the DataEase data-visualization tool lets an outside attacker take full control of your server without needing a password, so if you run DataEase you should update it now, but there's no sign yet that attackers are actively using it.

DataEase prior to 2.10.12 contains an unauthenticated remote code execution flaw (CWE-94) where the getJdbcUrl method fails to properly re-validate attacker-supplied JDBC connection strings, allowing the H2 driver to be smuggled past filtering logic and used to execute arbitrary code.

If you're affected

Full server takeover
Exposure of all connected databases
Data theft or manipulation
Operational disruption
Platform used as attacker foothold

What is it

DataEase is a tool businesses use to build dashboards and visualize their data. This flaw is like a hidden side door in that tool's connection settings — an attacker can slip in a crafted instruction that tricks the system into letting them run their own commands on the server, without needing any password or account. Once in, they effectively own that machine and anything it can reach, including connected databases.

Who is affected

This matters to you if your business runs DataEase for reporting or analytics, whether self-hosted or managed by an IT vendor on your behalf. It affects all versions before 2.10.12. Because no login or user interaction is needed, the risk applies as long as the DataEase server is reachable over the network — including from the internet if it's exposed there.

How urgent is it

This is a serious, easy-to-exploit flaw — it needs no password and no user action, and a public proof-of-concept exploit already exists, meaning attackers have the tools to act. There is no confirmed evidence yet of active exploitation in the wild, so treat this as an important, scheduled fix rather than a drop-everything emergency, but don't delay the upgrade for long given how trivial the attack is.

What to do — in detail

Confirm exposure by identifying your DataEase version; anything prior to 2.10.12 is vulnerable, with the flaw reachable in the default configuration over the network with no authentication. Upgrade to 2.10.12 or later, which fixes the getJdbcUrl validation logic (see vendor commit https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440). There is no documented breaking-change concern noted in available findings, but test in staging if your deployment is customized. If immediate patching isn't possible, restrict network access to the DataEase service (firewall rules, VPN, or reverse-proxy allowlisting) to prevent unauthenticated reach. This CVE is not currently in CISA's KEV catalog, so no federal remediation deadline applies. Monitor for a public GitHub PoC being adapted into active campaigns, and review access/connection logs for anomalous JDBC URL parameters referencing the H2 driver prior to patching.

Technical context

CVSS 3.1 score is 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, with high impact to confidentiality, integrity, and availability. The weakness is CWE-94 (Code Injection) via improper neutralization of the getJdbcUrl parameter, allowing the H2 JDBC driver to be specified despite filtering meant to block it. Exploit maturity is at proof-of-concept stage (one public GitHub PoC); it is not listed in CISA's KEV catalog and no confirmed in-the-wild exploitation has been reported. EPSS places predicted exploitation likelihood in a rising trend. Fixed in DataEase 2.10.12.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 184 days before any public exploit.

2026-10-03EPSS band changelow → moderateepss band change
2026-03-07Public exploit / PoCsource: github-poc
2025-09-03Patch availablerecord updated
2025-08-25Publishedweakness classified, att&ck mapped

Affected products

dataeasecommercial · CN
- dataeaseWeb AppOn-premEnterprise Software / document-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable