EasyReport CVE-2026-75979

Exploitation requires a valid low-privilege account on the EasyReport instance (PR:L per CVSS 4.0 vector) with access to the designer interface and its SQL Preview functionality (execSqlText or previewSqlText endpoints). No special non-default configuration is needed beyond a running EasyReport instance with the designer component accessible. Exploitation is limited by the mandatory authentication step - unauthenticated remote attackers cannot exploit this directly. Additionally, the actual impact ceiling is constrained by the Java template engine's sandbox policy: if the engine restricts class reflection or system calls, exploitation may be bounded to information disclosure rather than RCE. Specific platform or OS constraints are not identified in available data.

The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is notably conservative for an SSTI vulnerability - most SSTI findings in unsandboxed Java engines score significantly higher due to RCE potential. The E:P modifier in the provided vector confirms a public proof-of-concept exists, which elevates real-world risk above what the raw score implies. No CISA KEV listing is recorded, and no EPSS data was supplied, suggesting limited observed in-the-wild exploitation at this time. The PR:L metric confirms at least low-privilege authentication is required, which limits opportunistic mass exploitation but does not prevent insider threat or post-authentication attack chains. The product's obscure deployment footprint reduces population at risk. The conservative VC:L/VI:L/VA:L impact metrics may reflect only what the POC demonstrated rather than the theoretical ceiling of SSTI exploitation - defenders should treat this as potentially higher-impact until the template engine's sandbox configuration is confirmed by the vendor.

An authenticated low-privilege user logs into the EasyReport designer interface and submits a crafted template expression (e.g., a FreeMarker or Velocity payload) as the sqlText parameter to the SQL Preview endpoint. The application passes the unsanitized input directly to the template engine, which evaluates the expression server-side - disclosing sensitive data such as environment variables, configuration values, or internal file contents. A public POC demonstrating this behavior was posted to GitHub issue #82.