CVE-2026-49867

Deferred Deferred - Pending Action

Stored XSS in DataEase via SVG File Upload

Publication date: 2026-07-15

Last updated on: 2026-07-18

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-18

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-49867

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability in DataEase affecting template static resources. Authenticated users can upload SVG files with malicious scripts via specific endpoints. The files are saved without proper validation of extension, MIME type, or content, allowing stored XSS when victims access the SVG files.

Detection Guidance

Check for unauthorized SVG files in the /de2api/static-resource/ directory. Look for files with .svg extensions that may contain embedded scripts or unexpected content. Review server logs for POST requests to /de2api/templateManage/save or DataVisualizationServer.decompression with Base64-encoded data.

Impact Analysis

An attacker could execute arbitrary JavaScript in the context of the DataEase application when a victim views the malicious SVG file. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the victim within the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later. Remove any suspicious SVG files from the static-resource directory. Implement strict file upload validation for SVG files, including MIME type and content checks. Restrict write permissions to the static-resource directory.

Hi! I’m here to help you understand CVE-2026-49867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70