Threat Intelligence Database

A path traversal vulnerability exists in DTStack Taier 1.4.0 in the Paths.ge function of the FileChunkController.java component. This vulnerability allows remote attackers to manipulate the Name argument to traverse directories. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported.

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

CVE-2026-19762 is a path traversal vulnerability in DTStack Taier version 1.4.0. It affects the Paths.ge function in the FileChunkController.java file of the Chunk-Check Endpoint component. The vulnerability allows remote attackers to manipulate the argument 'Name' to perform path traversal. An exploit has been publicly disclosed, but no known exploitation in the wild has been reported. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

CVE-2026-19761 is a path traversal vulnerability in DTStack Taier version 1.4.0. It affects the MultipartFile.getOriginalFilename function in the UploadController component, allowing remote attackers to manipulate file paths. Upgrading to version 1.5.0 addresses this issue.

CVE-2026-11618 is an improper authentication vulnerability in DTStack Taier affecting versions up to 1.4.0. It exists in the preHandle function of the LoginInterceptor component related to the Source Connection Test Endpoint. This flaw allows remote attackers to bypass authentication mechanisms. The vulnerability has been publicly disclosed with an available patch identified by commit f95389e7f74acec42bcee079a616aaa06f9551d2. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-9437 is a medium severity OS command injection vulnerability in DTStack Taier version 1.4.0. It affects the Runtime.exec function of the REST API component, where manipulation of the sqlText argument can lead to remote OS command injection. The vulnerability is exploitable remotely without user interaction and requires low privileges. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available. Exploit details have been publicly disclosed, but no known exploits in the wild have been reported.

DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vulnerability

CriticalVulnerabilityChinaIndiaUnited States+6#cve#cve-2024-41579