CVE-2026-49867: DataEase: Authenticated Stored XSS in DataEase Template Static Resources
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49867?
CVE-2026-49867 has a risk score of 40, indicating a significant level of vulnerability.
What type of vulnerability is CVE-2026-49867?
CVE-2026-49867 is classified as an Authenticated Stored XSS vulnerability.
How do I fix CVE-2026-49867?
To fix CVE-2026-49867, upgrade to DataEase version 2.10.23 or later.
Who is affected by CVE-2026-49867?
Authenticated users of DataEase versions prior to 2.10.23 are affected by CVE-2026-49867.
What actions can lead to exploitation of CVE-2026-49867?
Exploitation of CVE-2026-49867 can occur when authenticated users submit template static resources through specific API endpoints.