{"id":"CVE-2026-19763","summary":"DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal","details":"A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.","modified":"2026-08-17T04:19:21.092181Z","published":"2026-08-14T00:15:08.895Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19763.json"},"references":[{"type":"WEB","url":"https://github.com/DTStack/Taier/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19763.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19763"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-19763"},{"type":"ADVISORY","url":"https://vuldb.com/submit/868967"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/389666"},{"type":"REPORT","url":"https://github.com/DTStack/Taier/issues/1204"},{"type":"REPORT","url":"https://vuldb.com/vuln/389666/cti"},{"type":"FIX","url":"https://github.com/DTStack/Taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729"},{"type":"FIX","url":"https://github.com/DTStack/Taier/releases/tag/v1.5.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dtstack/taier","events":[{"introduced":"726c3569c38ef4340f095d8f4edbd09ca4736c5e"},{"fixed":"ec8c59c76aceb04ab3080543ab2d9c6a4b674729"},{"fixed":"f4e300d7d7925ca56ccd94433197df2a567e0584"}],"database_specific":{"extracted_events":[{"introduced":"1.4.0"},{"last_affected":"1.4.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.4.0"],"database_specific":{"vanir_signatures_modified":"2026-08-17T04:19:21Z","vanir_signatures":[{"digest":{"function_hash":"54583743082426762956030578269126893767","length":349},"id":"CVE-2026-19763-1a390eaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-common/src/main/java/com/dtstack/taier/common/util/ZipUtil.java","function":"resolveZipEntryFile"},"deprecated":false},{"source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleClusterService.java","function":"addCluster"},"deprecated":false,"digest":{"function_hash":"232729819750595246656715184787564138956","length":277},"id":"CVE-2026-19763-1c2134ce","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"252110588856525027209762828285385381119","length":461},"id":"CVE-2026-19763-29a44c55","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584","target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java","function":"getConn"},"deprecated":false},{"target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java","function":"transHikari"},"deprecated":false,"digest":{"length":827,"function_hash":"238052077414147473175528123445295522804"},"id":"CVE-2026-19763-2e2efe85","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584"},{"id":"CVE-2026-19763-40915198","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java","function":"getLocalKerberosPath"},"deprecated":false,"digest":{"length":349,"function_hash":"41615206037729529139621469694446901"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java","function":"decryptionWithOutExpire"},"deprecated":false,"digest":{"function_hash":"210268226435147891574461985119480790415","length":657},"id":"CVE-2026-19763-504e1369"},{"deprecated":false,"digest":{"function_hash":"178031687960366436386792099211285137179","length":930},"id":"CVE-2026-19763-6bcb4058","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584","target":{"function":"decryption","file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java"}},{"id":"CVE-2026-19763-7a811deb","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleClusterService.java"},"deprecated":false,"digest":{"line_hashes":["176400449982846096101802390695556761997","57361077266586914201736469302913092323","336707423814470093847695372590499224110","107268716671079682944193076337668655162","7184990521328322339960019049636744921","245029628264058811057184715392249049787","91190488508155511994862498584936444444","60776415147120303579008511428814799723","167275402350719382388113901262942149770","253762592187505701887500557603559893697","137149389517721966076260074992309028201","310737019609393094223773677982404252188","121026408060005605800235647258346299966"],"threshold":0.9}},{"id":"CVE-2026-19763-8212af4b","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java","function":"updateComponentKerberosFile"},"deprecated":false,"digest":{"function_hash":"287691387672905718375524639337856273048","length":3168}},{"digest":{"line_hashes":["275864901931192623015453266675193674785","94851740730269435422703238219246816015","181497677642151634823746673462705005203","121442291405650256995355857260390870372","151058851383175872364051717010334460903","9207932180491954328625536679407701302","51695025061118893424834441010685588246","215104177409277922443554206401710026128","238765316486295980299037262498703051118","73862851277943086309289309692373940726","91963636966669605390307222390860205135"],"threshold":0.9},"id":"CVE-2026-19763-a17c21cd","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/console/ConsoleComponentService.java"},"deprecated":false},{"digest":{"line_hashes":["125207652754199758225664958899669835853","113754164451565641000613584342290843041","141425158978808431014691412966692470833","114363188307720565462939090333811399551","36601068879786074217074935712802022100","133822278915987205917951028871012943291","277953684701032936003686227368651036328","73347492585308774451832137588537897914","211546483702716288425633132004785933916","2638074789996013983460603480420169526","132662104378991811248035567767854969940","93278929754112218543959029082879225429","296845061050133467957579243309393489571","151147890598538299944212756230645561921"],"threshold":0.9},"id":"CVE-2026-19763-ab4bdecb","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584","target":{"file":"taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java"},"deprecated":false},{"id":"CVE-2026-19763-b219fd8b","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-common/src/test/java/com/dtstack/taier/common/util/ZipUtilTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["75976678486532560512579708802654151078","37313998970193933877273769618915037105","200489457005150856165245900089682782537","25991119174527194698080150863409967736","255879685200444006185406463048073397644","5474363699606682211800911024781156195"]}},{"deprecated":false,"digest":{"function_hash":"250764809978454954592126176983745784389","length":352},"id":"CVE-2026-19763-c52473fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-common/src/main/java/com/dtstack/taier/datasource/plugin/common/utils/ZipUtil.java","function":"resolveZipEntryFile"}},{"target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-common/src/main/java/com/dtstack/taier/datasource/plugin/common/utils/ZipUtil.java"},"deprecated":false,"digest":{"line_hashes":["66509683111625805662499148178334573483","279537589941028766250420676042234551081","129184063462529431153750033624275728989","166180371275502800268854341234045185223","202602175873262716423556944875794515049","84703034219650018321196437306483079167","26916205891439433460538008963778332557"],"threshold":0.9},"id":"CVE-2026-19763-c7319167","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729"},{"deprecated":false,"digest":{"line_hashes":["93930128593656849880593830323276055513","92240272106574236880109377557111947797","129184063462529431153750033624275728989","166180371275502800268854341234045185223","202602175873262716423556944875794515049","84703034219650018321196437306483079167","26916205891439433460538008963778332557"],"threshold":0.9},"id":"CVE-2026-19763-c82201cb","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/ec8c59c76aceb04ab3080543ab2d9c6a4b674729","target":{"file":"taier-common/src/main/java/com/dtstack/taier/common/util/ZipUtil.java"}},{"target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java","function":"getSimpleConn"},"deprecated":false,"digest":{"function_hash":"236775718364273575342317746185271799712","length":756},"id":"CVE-2026-19763-e85404c2","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584"},{"signature_version":"v1","source":"https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584","target":{"file":"taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java"},"deprecated":false,"digest":{"line_hashes":["35476722405304426314718055141130854298","16973448835063610288451592523618252216","208529561540805787307660125334485094702","233900185467647299823924075632775021527","106116714497235214317126491040361214858","219148540555351613109520622894201884615","97254051285827677200279067890710869194","44995672955429159814180400178989506082","160528109069049956057754407836615276621","119492301685871779104214419493479752856","227958328209535333101371665483180745996","106927720226904905315778844445831734310","91132970460554597457606242107045376336","302170076216052741506721647604372007224","94493790147554251692033773996287882352","111191101673056953953846148935517044768","14831340577830171425188789115927455234","274737605157407583061928697892153883614","281968164159869358151554821808630275726","3423668703749450574163292758860765687","329485612476973805250658545245075752673","255064482410696838331439574146571247252","15655972123580844902986151931643655478","59751113054416544808108457720687475633","122118838471393365148778894450929673690","73966362460831841439477427686330343594","287622994490669714933675734150734508998","232658759576845558036461462343177467376","158973815840826676194590650781040299185","253051636472804511029889529491915326187","225682506161643824595308298676092342009","266060369478870144866320966974863496529","99280198404030792824085209161719429458","14381875794951400378783882723412142605","200889065496396159670761705443025986305","324166437850423912578549953902630697095","132485060053145569814965282497041696471","183967761888338131550302499658054889141","290438919889072939929634167697564493499","217728902571395355879117313241969045991","121832372608264440280495193953948662472","125238076663653029723941085581757147327"],"threshold":0.9},"id":"CVE-2026-19763-fc5b0ca8","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19763.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}