CVE-2026-75979: EasyReport Template Engine RCE Vulnerability

CVE-2026-75979 Overview

CVE-2026-75979 affects xianrendzw EasyReport up to version 2.0.17.0522_Beta. The vulnerability resides in the execSqlText and previewSqlText functions within DesignerController.java, which form the SQL Preview Endpoint component. Attackers can manipulate the sqlText argument to trigger improper neutralization of special elements used in a template engine [CWE-791]. The attack executes remotely and requires low privileges. Exploit details have been published, and the maintainers have not responded to the initial issue report.

Critical Impact
Authenticated remote attackers can inject template engine directives through the sqlText parameter, potentially altering rendered output and disclosing limited data from the EasyReport instance.

Affected Products

xianrendzw EasyReport up to 2.0.17.0522_Beta
Component: SQL Preview Endpoint (DesignerController.java)
Affected functions: execSqlText and previewSqlText

Discovery Timeline

2026-08-19 - CVE-2026-75979 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75979

Vulnerability Analysis

The vulnerability is a template engine injection flaw classified under [CWE-791] (Incomplete Filtering of Special Elements). EasyReport exposes a SQL Preview Endpoint through DesignerController.java. The endpoint accepts a sqlText parameter and processes it through a template engine before executing the resulting SQL. Because the application does not neutralize template directives inside sqlText, attackers can embed template syntax that the engine evaluates server-side. The exploit has been made public, increasing exposure for exposed EasyReport instances.

Root Cause

The execSqlText and previewSqlText handlers pass user-controlled input directly to the underlying template engine without sanitizing template metacharacters. Any tokens recognized by the template engine are interpreted rather than treated as literal text.

Attack Vector

An authenticated user with low privileges sends an HTTP request to the SQL Preview Endpoint with a crafted sqlText value containing template engine expressions. The server evaluates the expressions during preview rendering. No user interaction is required beyond the attacker's own request. Impact spans limited confidentiality, integrity, and availability effects on the vulnerable component.

No verified proof-of-concept code is published in the referenced sources. Refer to the GitHub EasyReport Issue #82 and VulDB CVE-2026-75979 advisory for technical details.

Detection Methods for CVE-2026-75979

Indicators of Compromise

HTTP POST requests to EasyReport endpoints invoking execSqlText or previewSqlText with template metacharacters such as ${, #{, <%, or {{ inside the sqlText parameter.
Unexpected outbound network activity or process execution originating from the EasyReport Java process after preview requests.
Anomalous entries in EasyReport application logs showing template evaluation errors tied to the SQL preview functionality.

Detection Strategies

Inspect web server and application logs for requests targeting the SQL Preview Endpoint that include template engine syntax in the sqlText field.
Deploy web application firewall rules that flag template injection patterns on request bodies bound for /designer routes.
Correlate authenticated session activity with SQL preview requests to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Enable verbose request logging for DesignerController endpoints and forward logs to a centralized analytics platform.
Alert on repeated execSqlText or previewSqlText invocations from a single session in short time windows.
Monitor the EasyReport JVM for unexpected child processes, file writes, or outbound connections after preview activity.

How to Mitigate CVE-2026-75979

Immediate Actions Required

Restrict network access to EasyReport administrative interfaces so only trusted operators can reach the SQL Preview Endpoint.
Disable or remove designer functionality (execSqlText, previewSqlText) in production deployments until a patched release is available.
Rotate credentials for any EasyReport accounts with designer privileges and audit recent SQL preview activity.

Patch Information

No vendor patch is available at the time of publication. The maintainers of xianrendzw EasyReport have not responded to the disclosure via GitHub EasyReport Issue #82. Monitor the GitHub EasyReport Repository for future security releases.

Workarounds

Place EasyReport behind an authenticated reverse proxy that filters template metacharacters (${, #{, <%, {{) in the sqlText request parameter.
Enforce network segmentation so EasyReport cannot reach sensitive internal services if template evaluation is abused.
Remove designer role assignments from user accounts that do not require SQL preview capabilities.

bash

# Example nginx location block restricting the SQL Preview Endpoint by source IP
location ~* /designer/(execSqlText|previewSqlText) {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://easyreport_backend;
}