Executive brief
DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security vulnerability exists where an authenticated user can upload malicious files disguised as template resources. If another user views these resources, an attacker could execute unauthorized scripts in their browser, potentially leading to the theft of session information or unauthorized actions within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in DataEase prior to version 2.10.23. The application's template management and decompression flows (specifically via POST /de2api/templateManage/save) allow authenticated users to submit Base64-encoded content as static resources. The StaticResourceServer component writes these files to the public /de2api/static-resource/ directory without validating file extensions, MIME types, or SVG scriptability. Because this directory is mapped to a writable path and exempted from token authentication, an attacker can upload an SVG containing malicious JavaScript. When a victim loads the resource, the script executes within the same-origin context of the DataEase application.
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-27: patched: Fix committed to repository
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date