CVE-2026-49867 Overview
CVE-2026-49867 is a stored cross-site scripting (XSS) vulnerability in DataEase, an open source data visualization and analysis tool. Authenticated users can submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression. The server-side handlers StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded content to /de2api/static-resource/<name>.svg without validating file extension, MIME type, decoded bytes, or SVG scriptability. When a victim loads the stored resource, embedded scripts execute in the same origin as DataEase. The issue is fixed in version 2.10.23 [CWE-79].
Critical Impact
Authenticated attackers can store malicious SVG payloads that execute JavaScript in victims' browsers under the DataEase origin, enabling session theft and unauthorized actions.
Affected Products
- DataEase versions prior to 2.10.23
- DataEase template management API (/de2api/templateManage/save)
- DataEase data visualization decompression endpoint
Discovery Timeline
- 2026-07-15 - CVE-2026-49867 published to the National Vulnerability Database
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-49867
Vulnerability Analysis
The vulnerability affects DataEase's template static resource handling. Authenticated users can supply arbitrary content through the TemplateManageRequest.staticResource field. The server routes this content through StaticResourceServer.saveFilesToServe or StaticResourceServer.saveSingleFileToServe, which Base64-decode the payload and write it to disk under /de2api/static-resource/<name>.svg. Because no server-side check enforces the file extension, MIME type, decoded byte signatures, or SVG scriptability rules, an attacker can persist an SVG document containing inline <script> tags or event handlers. When any subsequent user loads the crafted resource, the browser interprets the SVG as XML with script execution enabled, running attacker code in the DataEase origin.
Root Cause
The root cause is missing input validation and improper neutralization of user-controlled content during template resource storage. The handlers trust the caller-supplied filename and body, storing content as SVG without sanitizing scriptable elements. This maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.
Attack Vector
An authenticated attacker submits a Base64-encoded SVG containing embedded JavaScript through the template save endpoint. The server persists the file under the DataEase static resource path. A victim, including administrators, triggers script execution simply by requesting the resource URL. Same-origin execution grants access to session cookies, CSRF tokens, and application state.
See the GitHub Security Advisory GHSA-jqxj-h53x-mpvf and GitHub Commit Details for the technical fix.
Detection Methods for CVE-2026-49867
Indicators of Compromise
- Unexpected .svg files written under /de2api/static-resource/ containing <script> tags, onload=, onerror=, or javascript: URIs
- POST requests to /de2api/templateManage/save containing large Base64 payloads in the staticResource field
- Outbound browser requests from authenticated DataEase sessions to attacker-controlled domains after loading template resources
Detection Strategies
- Inspect stored SVG files for scriptable XML elements such as <script>, <foreignObject>, and event handler attributes
- Alert on template save API calls that include SVG content submitted by non-administrator accounts
- Correlate anomalous session token usage with recent access to /de2api/static-resource/ paths
Monitoring Recommendations
- Enable audit logging on the template management and decompression endpoints
- Monitor filesystem writes to the static-resource directory and flag files whose decoded bytes do not match a permitted image signature
- Review web server access logs for unusual GET requests to newly created .svg resources
How to Mitigate CVE-2026-49867
Immediate Actions Required
- Upgrade DataEase to version 2.10.23 or later immediately
- Audit the /de2api/static-resource/ directory for SVG files containing script content and remove them
- Rotate active user sessions and administrative credentials if suspicious template uploads are found
- Restrict template management privileges to trusted accounts only
Patch Information
The vulnerability is fixed in DataEase 2.10.23. Review the GitHub Release v2.10.23 notes and the corresponding commit b00d9e3 that adds validation for extension, MIME type, decoded content, and SVG scriptability.
Workarounds
- Block or proxy-filter POST requests to /de2api/templateManage/save containing SVG payloads until patched
- Serve /de2api/static-resource/ content with a restrictive Content-Security-Policy header disallowing inline scripts
- Configure the web server to force Content-Disposition: attachment for SVG responses so browsers download rather than render them
- Remove template upload permissions from non-privileged roles as a defense-in-depth measure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
