Datavane vulnerabilities
We track 3 vulnerabilities in Datavane products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 14, 2026.
Latest Datavane vulnerabilities
- 7.7 High severity
tis: Improper Restriction of XML External Entity Reference
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpo
- 10.0 Critical severity
tis: Loop with Unreachable Exit Condition
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules). This vulnerability is associated with program files ChangeDomainAction.Java. This issue affects ti
- 10.0 Critical severity
tis: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules). This vulnerability is associated with program files XmlFile.Java. This issue a