CVE-2026-49867

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49867
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49867.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49867
Aliases
  • GHSA-jqxj-h53x-mpvf
Published
2026-07-15T19:41:52.701Z
Modified
2026-08-12T16:09:42.693238Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
DataEase: Authenticated Stored XSS in DataEase Template Static Resources
Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49867.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8
Fixed
cd4844cc45049e73a53d65e3a58454a167a3dffb
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.23"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0

Database specific

vanir_signatures 
[
    {
        "target": {
            "function": "saveFilesToServe",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-11150e7b",
        "signature_type": "Function",
        "digest": {
            "function_hash": "113005996331321522794832412250175560239",
            "length": 291.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "isValidSvgMimeType",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-53a8620a",
        "signature_type": "Function",
        "digest": {
            "function_hash": "76396485253081921410020017497592718376",
            "length": 268.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "isImageOther",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-59850d55",
        "signature_type": "Function",
        "digest": {
            "function_hash": "17366307324634535379633180240991836272",
            "length": 338.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "isValidSVG",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-8225e6dd",
        "signature_type": "Function",
        "digest": {
            "function_hash": "212401550908611285945552713330407322954",
            "length": 1311.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "upload",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-8ceab521",
        "signature_type": "Function",
        "digest": {
            "function_hash": "21318059724535304602955746941849821506",
            "length": 708.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "saveSingleFileToServe",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-97ae5929",
        "signature_type": "Function",
        "digest": {
            "function_hash": "244973069168762262853837771641348169128",
            "length": 519.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-a08be5d8",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "330038413489144209071661847199749594299",
                "121458877091200228084364326184359389121",
                "201564277215463141105426247670472367285",
                "309233096079073246104829704855826364351",
                "44233781341740472992052807052115089080",
                "143110649451206668047139111503534957460",
                "193437091293987751278352846263527764957",
                "11498101729291506458072716813377250060",
                "94175071629815927721504392093501774830",
                "121991062755425059917728643420189110418",
                "166885528952330253474752935348278033278",
                "119985540174848989066645919054182722827",
                "15629512976749658794722811382621572446",
                "17303017849773566721342426234568877385",
                "206039906509849864257444517889694318849",
                "1256510452284012695568097776984087860",
                "70756985425944495459157672440425632851",
                "247566828447778310989184589150507655758",
                "59890738142733435657412939680167495755",
                "308281950549341022535206009198640375325",
                "209152498261475667932569454636967942755",
                "228620802789221139565284459893313315428",
                "231617317777981713747885647934222099294",
                "132269749254595665590838560280185829671",
                "132432340700859628051902703872553733723",
                "277160476330731417073691219416708164796",
                "231010183019028384490613911723859828144",
                "83894328270064301480601323117173912634",
                "35093117531430889663912366561589101391",
                "2612896179759043306094123096310659549",
                "287414047424234863270515174356033913306",
                "279057028653250757362668957491005794633",
                "217979571088167861226776918739221056406",
                "159526638298723564198267717605168091884",
                "219393530592580213178666312226206079201",
                "241658736816735832867298589942351686155",
                "328227988349972836632744711446178616018",
                "152515188152805505040543325426584746922",
                "110712563980852686968811715458980884729",
                "284579589127864264373875824253863792142",
                "217103379437844574198226014803795625951",
                "13800873712145859106387897726563032273",
                "198822801741452255991296873990061025524",
                "296404339049231889720733896349677485382",
                "55776754568664887035887255906525791861",
                "254283165304699405380016061420309289910",
                "187015864642697724637968024903654911225",
                "153633308918923026132097169164344321279",
                "22828162039683943724874260689867933260",
                "58206778960503552121295098818300314773",
                "139323427906979891137560618020608685388",
                "154828770109370041801559162062893604174",
                "147877087326994025005730635002170852484",
                "13430584979454890295228550899916480510",
                "20766866008734950291643547281447890497",
                "32364470512220340197300272283220945099",
                "102773042227712380051185624212894701760",
                "193945555105656936453847297800470789796",
                "290737094359169431022024476466638772584",
                "199069346324368088160728439697954304745",
                "263685648065114653128444297422639893744",
                "2922000750376693516039562766620996810",
                "316245481046680165177452274470627220396",
                "157408526516567545327236107902599127248",
                "178993143288371448541309966749085206705",
                "243103733801007426969415424828963941873",
                "182318208030410619974058079261398009052",
                "269534943602401147676805962072664687032",
                "19290027181308628029834340496460871598",
                "122224822863523104188089761824552400696",
                "105135349804760838859480469610730392589",
                "267308406857672712789799601732577414058",
                "48329145264164198558736818476755056138",
                "245000431136525937139821626342714449917",
                "34230415410645002172098208322707955981",
                "105587882417304371653444300591569075495",
                "75475449969745620208462103173806681968",
                "38401682576329684785970694681704979689",
                "71282209229680973668753310463115064293",
                "29361025868014040228298992981404818046",
                "325884330858060518466399077584758792909",
                "5458394708047608981339201057897735280",
                "293746996294794522138906328108515937187",
                "14923399273712064734376381021918859393",
                "139646627688494381927245469217625998809",
                "51345153166875857886698604121672964693",
                "140647389704389864748981328652394133003",
                "158811789995246241912265196111931749919",
                "167375187836530270969519555908781006301",
                "268281597905266046609863820326572011330",
                "203226683756014879456690758529153419907",
                "275352522429518855380547019910111442826",
                "175792267273927573385034862581478054463",
                "320310210757982665234076884085236925264",
                "167972445541570807624757740174432772739",
                "232326354018755822716937007481095653621",
                "102754131467077401526789104656731185268",
                "319770667533374120800119137984506931722",
                "157089429186305996816824772755261745185",
                "178081178188354383598691734693904760573",
                "289315858808412944173260415779969434117",
                "268775024718095393156530525785946952367",
                "199429279552119462916093996011172705869",
                "254587850834448707834978747168628167885",
                "262534639727292079691092347766931181071",
                "134841229961546412185126448879502364365",
                "5784191614058260916523964179426482077",
                "191030403299871298014566886997312975349",
                "133207939623022657992899963167993668305",
                "291047110986049504931200183700591310417",
                "255581030440111965961382251135753927030",
                "5466063160536583933969677925681117711",
                "9621730702633450433118241717373546561",
                "52350246681227432066035908075799118290",
                "305676151783693152861573028793179922713",
                "32514637774401235614851498184014866145",
                "109197733482276625293739584148154199211",
                "122793096253718790167923609208804298839",
                "218579405656751232027418743860135503035",
                "230432767747245469814205243602535490216",
                "132461806443113253285997030841364542551",
                "306789114157130917329875546084450941728",
                "222935410460591746842270364672543360619",
                "109310585020134901133379258025073875375",
                "189814504487151116747621554644464510618",
                "314400194388436753018442094102675413844",
                "147411429188384437534103698936780323595",
                "194732853714192965269891172929339498957",
                "194126052271953435141107695908973227735",
                "246414226564961582474109918379679341911",
                "324095928389400535636436519294253470112",
                "262575378068353717865490527480383457508",
                "203124660671868621194162287795987275093",
                "306172667666146133412086921990901516764",
                "288184082698963654915777802268365447218",
                "75057657642423714500610976249322628720",
                "142950872386809619102541730272535055700",
                "96408248016305179854090928575892615372",
                "189770019702098729424887576072342884307",
                "338279563292320243216226533132758036027",
                "330392048579306920175393388856572830926",
                "260531341673046317419611868874795517565",
                "100362314948467327672990820237193679975",
                "87573834467713005356557472768248474882",
                "79906007109479857191472714795010878162",
                "212602762501643714895912080417904821928",
                "132654875806452565194215395866977257570",
                "193945555105656936453847297800470789796",
                "26141999522257747027571487778623453499",
                "191862732064397935620451295594086657497",
                "238751377372008688711877531910602266173",
                "100393720944775112266166873591613291348",
                "218269764023773917731605265433900345242",
                "5675554244271692772635249637609309248",
                "83598244548982322012655680048174084618",
                "56201083262500352244236489289630525427",
                "175162824475134958855042653668388684021",
                "276060785804928099622193103734216479118",
                "3695916188350584900365958057188670050",
                "42155590985013088699814075326540238606",
                "159763676273714654584368031668865711618",
                "217347109822449791652477194243267461085"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "isImage",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-c6443d76",
        "signature_type": "Function",
        "digest": {
            "function_hash": "30714112804110602682340172690277429017",
            "length": 306.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    },
    {
        "target": {
            "function": "hasValidImageExtension",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java"
        },
        "id": "CVE-2026-49867-fdf7b1e7",
        "signature_type": "Function",
        "digest": {
            "function_hash": "278702114118486424691910281328170099677",
            "length": 296.0
        },
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T16:09:42Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49867.json"