EUVD-2026-44786Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requires low-privilege auth to plant and passive victim load; scope changes because script executes in victim's browser origin context, not attacker's.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.
AnalysisAI
Stored cross-site scripting in DataEase's template static resource pipeline allows authenticated users to persist malicious JavaScript inside SVG files served at the application's same origin, executing in victims' browsers upon resource access. Versions prior to 2.10.23 are affected; the root cause is that StaticResourceServer.saveFilesToServe and saveSingleFileToServe decoded attacker-supplied Base64 content and wrote it directly to disk without validating extension, MIME type, decoded bytes, or SVG scriptability. No public exploit code or CISA KEV listing exists at time of analysis, but the stored, same-origin nature of the XSS and the low bar for triggering it (any authenticated user) make this a meaningful risk in shared or multi-tenant DataEase deployments.
Technical ContextAI
DataEase is a Java-based open-source BI and data-visualization platform (CPE: cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*). The vulnerable code path begins when an authenticated user submits a TemplateManageRequest.staticResource payload via POST /de2api/templateManage/save or DataVisualizationServer.decompression. StaticResourceServer.saveSingleFileToServe accepted a filename and Base64-encoded content string, decoded the content with Base64.getDecoder().decode(), and wrote the resulting bytes to /de2api/static-resource/<name>.svg using FileCopyUtils.copy - with no validation of the filename extension, the MIME type, the decoded byte content, or SVG-specific scriptability (inline script/event-handler elements). Because SVG is rendered as XML by browsers and executes JavaScript in the document's origin context, storing attacker-controlled SVG content at a predictable same-origin URL is sufficient for reflected-into-stored XSS. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the correct root-cause class. The fix in commit b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8 introduces ALLOWED_IMAGE_EXTENSIONS and ALLOWED_SVG_MIME_TYPES allowlists, a validateImageFilename() guard, MIME-type validation for SVG content, and safe Base64 decoding with error handling.
RemediationAI
The primary fix is to upgrade DataEase to version 2.10.23, which is confirmed available at https://github.com/dataease/dataease/releases/tag/v2.10.23 and includes the complete validation rewrite in StaticResourceServer. The patched code enforces an extension allowlist, MIME-type validation for SVG uploads, and content-level byte inspection before writing. If immediate upgrade is not possible, organizations should restrict access to the POST /de2api/templateManage/save endpoint and the DataVisualizationServer decompression API to the minimum set of trusted users at the API gateway or WAF layer - be aware this will prevent legitimate template import workflows. A secondary compensating control is to configure a Content-Security-Policy header on the /de2api/static-resource/ path that disallows inline scripts (script-src 'none' or a strict nonce policy), which would prevent JavaScript execution even if malicious SVGs are uploaded; however, SVG event handlers (onerror, onload) may still fire depending on browser handling and CSP scope. The GitHub advisory at GHSA-jqxj-h53x-mpvf is the authoritative vendor reference.
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor m
Auth bypass in DataEase via CVE-2025-49001 patch evasion. PoC available.
Auth bypass in DataEase BI tool before 2.10.10.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
DataEase data visualization tool prior to 2.10.19 uses MD5-hashed passwords without salting, allowing attackers to crack
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
DataEase is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability
Dataease is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability
Dataease is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today