Skip to main content

EasyReport CVE-2026-75979

| EUVDEUVD-2026-62215 LOW
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
2026-08-19 VulDB GHSA-gwjc-mxgh-5h28
Ssti Information Disclosure Java Easyreport
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication; impact capped at Low across C/I/A reflecting demonstrated POC scope, pending sandbox confirmation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 19, 2026 - 05:22 vuln.today
Severity Changed
Aug 19, 2026 - 01:22 NVD
MEDIUM LOW
CVSS changed
Aug 19, 2026 - 01:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Aug 19, 2026 - 00:45 cve.org
LOW 2.1

DescriptionCVE.org

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege EasyReport credentials
Delivery
Authenticate to designer interface
Exploit
Submit crafted template payload in sqlText to SQL Preview endpoint
Execution
Template engine evaluates injected expression server-side
Impact
Extract sensitive configuration data or escalate to code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid low-privilege account on the EasyReport instance (PR:L per CVSS 4.0 vector) with access to the designer interface and its SQL Preview functionality (execSqlText or previewSqlText endpoints). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is notably conservative for an SSTI vulnerability - most SSTI findings in unsandboxed Java engines score significantly higher due to RCE potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated low-privilege user logs into the EasyReport designer interface and submits a crafted template expression (e.g., a FreeMarker or Velocity payload) as the sqlText parameter to the SQL Preview endpoint. The application passes the unsanitized input directly to the template engine, which evaluates the expression server-side - disclosing sensitive data such as environment variables, configuration values, or internal file contents. …
Remediation No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the coordinated disclosure reported via GitHub issue https://github.com/xianrendzw/EasyReport/issues/82. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ssti

View all
CVE-2024-23692 CRITICAL POC
9.8 May 31

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
CVE-2025-47916 CRITICAL POC
10.0 May 16

Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
CVE-2024-6386 CRITICAL POC
9.9 Aug 21

Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
CVE-2025-23211 CRITICAL POC
9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
CVE-2024-32651 CRITICAL POC
10.0 Apr 26

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
CVE-2024-4040 CRITICAL POC
10.0 Apr 22

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
CVE-2026-15734 CRITICAL POC
9.8 Aug 06

Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
CVE-2024-24724 CRITICAL POC
9.8 Apr 03

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
CVE-2026-28496 CRITICAL POC
9.4 Jun 23

Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
CVE-2025-1040 HIGH POC
8.8 Mar 20

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
CVE-2026-69118 HIGH POC
8.7 Aug 10

Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directive
CVE-2023-6709 HIGH POC
8.8 Dec 12

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all
CVE-2024-23692 CRITICAL POC
9.8
CVE-2025-47916 CRITICAL POC
10.0
CVE-2025-49619 HIGH POC
8.5
CVE-2024-6386 CRITICAL POC
9.9
CVE-2025-69516 HIGH POC
8.8
CVE-2025-49136 CRITICAL POC
9.0
CVE-2025-53833 CRITICAL POC
10.0
CVE-2025-23211 CRITICAL POC
9.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-75979 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy