Is CVE-2026-49867 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49867 being exploited in the wild.

How severe is CVE-2026-49867?

Informational severity, with a CVSS score of 6.3, published 15 July 2026.

Is there a fix for CVE-2026-49867?

A patch was published on 2026-05-27: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49867 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49867?

Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49867: DataEase stored XSS in template static resources

CVE-2026-49867 · Severity: info · CVSS 6.3 · Published 2026-07-15

DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security vulnerability exists where an authenticated user can upload malicious files disguised as template resources. If another user views these resources, an attacker could execute unauthorized scripts in their browser, potentially leading to the theft of session information or unauthorized actions within the application.

Technologies: DataEase. Vendors: DataEase.

Quick answers

Is CVE-2026-49867 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49867 being exploited in the wild.
How severe is CVE-2026-49867?: Informational severity, with a CVSS score of 6.3, published 15 July 2026.
Which products and versions are affected?: DataEase < 2.10.23.
Is there a fix for CVE-2026-49867?: A patch was published on 2026-05-27: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49867 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49867?: Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in DataEase prior to version 2.10.23. The application's template management and decompression flows (specifically via POST /de2api/templateManage/save) allow authenticated users to submit Base64-encoded content as static resources. The StaticResourceServer component writes these files to the public /de2api/static-resource/ directory without validating file extensions, MIME types, or SVG scriptability. Because this directory is mapped to a writable path and exempted from token authentication, an attacker can upload an SVG containing malicious JavaScript. When a victim loads the resource, the script executes within the same-origin context of the DataEase application.

Affected products

DataEase DataEase < 2.10.23

Timeline

2026-05-27: patched: Fix committed to repository
2026-05-28: advisory: GitHub Security Advisory published
2026-07-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.