CVE-2026-75978: xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs remote network access and low-privileged access to the affected EasyReport instance. No user interaction is required.
What capabilities could exploitation provide?
The vulnerability is rated as affecting confidentiality, integrity, and availability at low impact. It involves a permission issue caused by manipulation of the queryerClass argument in DataSourceController.add.
Which versions are affected?
xianrendzw EasyReport versions up to and including 2.0.17.0522_Beta are reported as affected.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information states that the project was notified through an issue report but had not responded at the time of publication. No fix or mitigation is identified in the available data.