Threats affecting pkg:github/dtstack/Taier

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

CVE-2026-19762 is a path traversal vulnerability in DTStack Taier version 1.4.0. It affects the Paths.ge function in the FileChunkController.java file of the Chunk-Check Endpoint component. The vulnerability allows remote attackers to manipulate the argument 'Name' to perform path traversal. An exploit has been publicly disclosed, but no known exploitation in the wild has been reported. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-19761 is a path traversal vulnerability in DTStack Taier version 1.4.0. It affects the MultipartFile.getOriginalFilename function in the UploadController component, allowing remote attackers to manipulate file paths. Upgrading to version 1.5.0 addresses this issue.

CVE-2026-11618 is an improper authentication vulnerability in DTStack Taier affecting versions up to 1.4.0. It exists in the preHandle function of the LoginInterceptor component related to the Source Connection Test Endpoint. This flaw allows remote attackers to bypass authentication mechanisms. The vulnerability has been publicly disclosed with an available patch identified by commit f95389e7f74acec42bcee079a616aaa06f9551d2. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-9437 is a medium severity OS command injection vulnerability in DTStack Taier version 1.4.0. It affects the Runtime.exec function of the REST API component, where manipulation of the sqlText argument can lead to remote OS command injection. The vulnerability is exploitable remotely without user interaction and requires low privileges. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available. Exploit details have been publicly disclosed, but no known exploits in the wild have been reported.

DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vulnerability