CVE-2023-40772
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS probability
- 1.01%
- CWE
- CWE-23
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- DataEase DataEase
Weakness type
Related vulnerabilities
- CVE-2025-64446 — A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
- CVE-2025-55752 — Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-52207 — PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
- CVE-2026-33494 — Ory Oathkeeper has a path traversal authorization bypass
- CVE-2025-62878 — Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
- CVE-2025-3365 — Relative Path Traversal in OnlineSuite
- CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability