CVE-2025-56815

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.

Affected products

Datart

Running-elephant Datart

= 1.0.0

Fix

Available

CVSS 3.1

7.1 HIGH

EPSS

0.6% (45th percentile)

Weakness

CWE-22

NVD status

Analyzed

Published

2025-09-24