{"id":"CVE-2026-49867","summary":"DataEase: Authenticated Stored XSS in DataEase Template Static Resources","details":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/\u003cname\u003e.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.","aliases":["GHSA-jqxj-h53x-mpvf"],"modified":"2026-08-12T16:09:42.693238Z","published":"2026-07-15T19:41:52.701Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49867.json"},"references":[{"type":"WEB","url":"https://github.com/dataease/dataease/releases/tag/v2.10.23"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49867.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-jqxj-h53x-mpvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49867"},{"type":"FIX","url":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"0"},{"fixed":"b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8"},{"fixed":"cd4844cc45049e73a53d65e3a58454a167a3dffb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.23"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.6.0","v2.3.0","v2.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49867.json","vanir_signatures_modified":"2026-08-12T16:09:42Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"saveFilesToServe"},"deprecated":false,"digest":{"function_hash":"113005996331321522794832412250175560239","length":291},"id":"CVE-2026-49867-11150e7b","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"isValidSvgMimeType"},"deprecated":false,"digest":{"function_hash":"76396485253081921410020017497592718376","length":268},"id":"CVE-2026-49867-53a8620a","signature_type":"Function"},{"deprecated":false,"digest":{"length":338,"function_hash":"17366307324634535379633180240991836272"},"id":"CVE-2026-49867-59850d55","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"isImageOther"}},{"deprecated":false,"digest":{"function_hash":"212401550908611285945552713330407322954","length":1311},"id":"CVE-2026-49867-8225e6dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"function":"isValidSVG","file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"upload"},"deprecated":false,"digest":{"function_hash":"21318059724535304602955746941849821506","length":708},"id":"CVE-2026-49867-8ceab521"},{"source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"saveSingleFileToServe"},"deprecated":false,"digest":{"function_hash":"244973069168762262853837771641348169128","length":519},"id":"CVE-2026-49867-97ae5929","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["330038413489144209071661847199749594299","121458877091200228084364326184359389121","201564277215463141105426247670472367285","309233096079073246104829704855826364351","44233781341740472992052807052115089080","143110649451206668047139111503534957460","193437091293987751278352846263527764957","11498101729291506458072716813377250060","94175071629815927721504392093501774830","121991062755425059917728643420189110418","166885528952330253474752935348278033278","119985540174848989066645919054182722827","15629512976749658794722811382621572446","17303017849773566721342426234568877385","206039906509849864257444517889694318849","1256510452284012695568097776984087860","70756985425944495459157672440425632851","247566828447778310989184589150507655758","59890738142733435657412939680167495755","308281950549341022535206009198640375325","209152498261475667932569454636967942755","228620802789221139565284459893313315428","231617317777981713747885647934222099294","132269749254595665590838560280185829671","132432340700859628051902703872553733723","277160476330731417073691219416708164796","231010183019028384490613911723859828144","83894328270064301480601323117173912634","35093117531430889663912366561589101391","2612896179759043306094123096310659549","287414047424234863270515174356033913306","279057028653250757362668957491005794633","217979571088167861226776918739221056406","159526638298723564198267717605168091884","219393530592580213178666312226206079201","241658736816735832867298589942351686155","328227988349972836632744711446178616018","152515188152805505040543325426584746922","110712563980852686968811715458980884729","284579589127864264373875824253863792142","217103379437844574198226014803795625951","13800873712145859106387897726563032273","198822801741452255991296873990061025524","296404339049231889720733896349677485382","55776754568664887035887255906525791861","254283165304699405380016061420309289910","187015864642697724637968024903654911225","153633308918923026132097169164344321279","22828162039683943724874260689867933260","58206778960503552121295098818300314773","139323427906979891137560618020608685388","154828770109370041801559162062893604174","147877087326994025005730635002170852484","13430584979454890295228550899916480510","20766866008734950291643547281447890497","32364470512220340197300272283220945099","102773042227712380051185624212894701760","193945555105656936453847297800470789796","290737094359169431022024476466638772584","199069346324368088160728439697954304745","263685648065114653128444297422639893744","2922000750376693516039562766620996810","316245481046680165177452274470627220396","157408526516567545327236107902599127248","178993143288371448541309966749085206705","243103733801007426969415424828963941873","182318208030410619974058079261398009052","269534943602401147676805962072664687032","19290027181308628029834340496460871598","122224822863523104188089761824552400696","105135349804760838859480469610730392589","267308406857672712789799601732577414058","48329145264164198558736818476755056138","245000431136525937139821626342714449917","34230415410645002172098208322707955981","105587882417304371653444300591569075495","75475449969745620208462103173806681968","38401682576329684785970694681704979689","71282209229680973668753310463115064293","29361025868014040228298992981404818046","325884330858060518466399077584758792909","5458394708047608981339201057897735280","293746996294794522138906328108515937187","14923399273712064734376381021918859393","139646627688494381927245469217625998809","51345153166875857886698604121672964693","140647389704389864748981328652394133003","158811789995246241912265196111931749919","167375187836530270969519555908781006301","268281597905266046609863820326572011330","203226683756014879456690758529153419907","275352522429518855380547019910111442826","175792267273927573385034862581478054463","320310210757982665234076884085236925264","167972445541570807624757740174432772739","232326354018755822716937007481095653621","102754131467077401526789104656731185268","319770667533374120800119137984506931722","157089429186305996816824772755261745185","178081178188354383598691734693904760573","289315858808412944173260415779969434117","268775024718095393156530525785946952367","199429279552119462916093996011172705869","254587850834448707834978747168628167885","262534639727292079691092347766931181071","134841229961546412185126448879502364365","5784191614058260916523964179426482077","191030403299871298014566886997312975349","133207939623022657992899963167993668305","291047110986049504931200183700591310417","255581030440111965961382251135753927030","5466063160536583933969677925681117711","9621730702633450433118241717373546561","52350246681227432066035908075799118290","305676151783693152861573028793179922713","32514637774401235614851498184014866145","109197733482276625293739584148154199211","122793096253718790167923609208804298839","218579405656751232027418743860135503035","230432767747245469814205243602535490216","132461806443113253285997030841364542551","306789114157130917329875546084450941728","222935410460591746842270364672543360619","109310585020134901133379258025073875375","189814504487151116747621554644464510618","314400194388436753018442094102675413844","147411429188384437534103698936780323595","194732853714192965269891172929339498957","194126052271953435141107695908973227735","246414226564961582474109918379679341911","324095928389400535636436519294253470112","262575378068353717865490527480383457508","203124660671868621194162287795987275093","306172667666146133412086921990901516764","288184082698963654915777802268365447218","75057657642423714500610976249322628720","142950872386809619102541730272535055700","96408248016305179854090928575892615372","189770019702098729424887576072342884307","338279563292320243216226533132758036027","330392048579306920175393388856572830926","260531341673046317419611868874795517565","100362314948467327672990820237193679975","87573834467713005356557472768248474882","79906007109479857191472714795010878162","212602762501643714895912080417904821928","132654875806452565194215395866977257570","193945555105656936453847297800470789796","26141999522257747027571487778623453499","191862732064397935620451295594086657497","238751377372008688711877531910602266173","100393720944775112266166873591613291348","218269764023773917731605265433900345242","5675554244271692772635249637609309248","83598244548982322012655680048174084618","56201083262500352244236489289630525427","175162824475134958855042653668388684021","276060785804928099622193103734216479118","3695916188350584900365958057188670050","42155590985013088699814075326540238606","159763676273714654584368031668865711618","217347109822449791652477194243267461085"]},"id":"CVE-2026-49867-a08be5d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"},"deprecated":false},{"target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"isImage"},"deprecated":false,"digest":{"function_hash":"30714112804110602682340172690277429017","length":306},"id":"CVE-2026-49867-c6443d76","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8"},{"id":"CVE-2026-49867-fdf7b1e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java","function":"hasValidImageExtension"},"deprecated":false,"digest":{"function_hash":"278702114118486424691910281328170099677","length":296}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N"}]}