CVE-2026-75979

Deferred Deferred - Pending Action

SQL Injection in EasyReport via SQL Preview Endpoint

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: VulDB

Description

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75979

EUVD

EUVD-2026-62215

Affected Vendors & Products

Vendor	Product	Version / Range
xianrendzw	easyreport	to 2.0.17.0522_Beta (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-791	The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Template Injection (SSTI) in EasyReport versions up to 2.0.17.0522_Beta. It affects the SQL preview endpoints where the sqlText parameter is passed to the Apache Velocity template engine without proper neutralization. This allows attackers to inject malicious templates that can execute remote code on the server.

Detection Guidance

Check for unauthorized access to the SQL Preview Endpoint in EasyReport by monitoring HTTP requests to /DesignerController/execSqlText or /DesignerController/previewSqlText. Look for suspicious sqlText parameters containing template injection payloads like ${...} or #set(). Review logs for Velocity engine errors or unexpected Java class accesses.

Impact Analysis

An authenticated user with report designer permissions could exploit this to execute arbitrary code on the server. This could lead to data breaches, unauthorized access, or system compromise. The exploit is remotely executable and has been publicly disclosed.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and legal penalties.

Mitigation Strategies

Immediately upgrade to the latest version of EasyReport if available. If not, disable the SQL Preview Endpoint by restricting access to /DesignerController/execSqlText and /DesignerController/previewSqlText. Implement input validation to sanitize sqlText parameters and restrict user permissions to only necessary report.designer:view access.

Hi! I’m here to help you understand CVE-2026-75979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70