DataEase CVE-2026-49867

Exploitation requires a valid authenticated session with at least low-privilege access to the DataEase application - unauthenticated exploitation is not possible per the PR:L CVSS metric. The attacker must be able to reach the POST /de2api/templateManage/save endpoint or trigger DataVisualizationServer.decompression, which are standard template management features available to authenticated users. Exploitation is not limited to administrators or special roles based on available data; any user who can submit template resources is sufficient. A victim with an active authenticated session must subsequently load or preview the resource that contains the malicious SVG, satisfying the UI:P (passive interaction) requirement - in a typical multi-user BI environment this occurs naturally during dashboard or template review workflows. What limits exploitation: the requirement for at least one valid user account (no anonymous path), the need for a second victim to load the resource (not self-executing without victim action), and the scope being confined to the DataEase same-origin session context (cannot directly pivot to other systems without chaining further exploits).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N) scores 6.3 and accurately reflects the attack profile: network-reachable, low complexity, authenticated low-privilege initiator, passive victim interaction required. The high subsequent-system confidentiality and integrity impact (SC:H/SI:H) is appropriate because same-origin XSS can steal session tokens, exfiltrate dashboard data, or perform actions as the victim user - all within the DataEase application context. EPSS data was not provided, and this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation signal exists. The combination of PR:L (any authenticated user can plant the payload) and a stored delivery mechanism (no need to social-engineer a click on a crafted link) pushes real-world risk above what the mid-range numerical score implies for environments where multiple users share a DataEase instance. The primary limiting factor is the UI:P requirement - a victim must load the served resource. For deployments where templates and their static resources are routinely shared or previewed by other users (the primary use case), this condition is easily met in practice. No conflicting signals exist between the CVSS vector and the vulnerability description.

An attacker with a low-privilege DataEase account crafts a template import package or API request to POST /de2api/templateManage/save containing a Base64-encoded SVG file embedding a JavaScript payload (for example, a script tag or onload event handler that exfiltrates document.cookie to an attacker-controlled server). The SVG is written to /de2api/static-resource/<name>.svg on the server. When an administrator or another user previews the template or navigates to a dashboard that references the resource, their browser fetches and renders the SVG from the same origin, executing the injected script in the victim's authenticated session context.