CVE-2026-108824: DataEase Utils.java Utils.buildCalcField sql injection
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-04 15:41 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.
Description quoted from the CVE record (assigned by VulDB, published 2026-10-12).
Weakness: SQL Injection; Injection
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and no user interaction. Impact: confidentiality low, integrity low, availability low. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Exploit Observer found 3 code repositories naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 6 references on Exploit Observer
Live scores
- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| DataEase | version 3.0 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Vendor guidance:
- https://github.com/dataease/dataease/pull/19285 (issue-tracking, patch)
- https://github.com/dataease/dataease/commit/8509e218e6c1f0080eee9e379f269b2104785ef7 (patch)
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-108824 DataEase - SQL Injection. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-108824 DataEase - SQL Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/de2api/datasetData/previewData"; nocase; fast_pattern; http.request_body; content:"extField"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-108824; reference:url,https://www.exploit.observer/?keyword=CVE-2026-108824&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=dataease&match=exact; sid:1085202; rev:1;)
CVE-2026-108824.rules on GitHub
References
Vendor advisories and patches
- https://github.com/dataease/dataease/pull/19285 (issue-tracking, patch)
- https://github.com/dataease/dataease/commit/8509e218e6c1f0080eee9e379f269b2104785ef7 (patch)
Exploit code
Technical analysis and advisories
- VDB-416600 | DataEase Utils.java Utils.buildCalcField sql injection (vdb-entry, technical-description)
- CVE-2026-108824 | CVE Analysis and Report (third-party-advisory)
- Submit #964784 | DataEase <= 3.0.0 (main, unfixed) SQL Injection (third-party-advisory)
Other references
- VDB-416600 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- https://github.com/k4z01/DataEase-Authenticated-SQL-Injection-/blob/main/README.md (related)
- https://github.com/dataease/dataease/ (product)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
