Datart vulnerabilities

2 known vulnerabilities in Datart from Running-elephant. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Datart: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-56816Sep 24, 2025Running-elephantEPSS 1.35%

  Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load()

• 7.1 High severity

  Datart: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-56815Sep 24, 2025Running-elephant

  Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.