CVE-2026-123992

Description

A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses."

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-79, CWE-94
Reserved: 2026-11-06
Published: 2026-11-07 17:15 UTC
Last updated: 2026-11-07 17:15 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123992.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119318

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
n/a	DataEase	`2.10.0` (affected), `2.10.1` (affected), `2.10.2` (affected), `2.10.3` (affected), `2.10.4` (affected), `2.10.5` (affected), `2.10.6` (affected), `2.10.7` (affected), `2.10.8` (affected), `2.10.9` (affected), `2.10.10` (affected), `2.10.11` (affected), `2.10.12` (affected), `2.10.13` (affected), `2.10.14` (affected), `2.10.15` (affected), `2.10.16` (affected), `2.10.17` (affected), `2.10.18` (affected), `2.10.19` (affected), `2.10.20` (affected), `2.10.21` (affected), `2.10.22` (affected), `2.10.23` (affected), `2.10.24` (affected), `2.10.25` (affected), `2.10.26` (affected), `2.10.27` (affected), `2.10.28` (unaffected)	—

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

VDB-432071 | DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting vdb-entrytechnical-description
VDB-432071 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-123992 | CVE Analysis and Report third-party-advisory
Submit #1035492 | FIT2CLOUD DataEase (the vulnerable SVG validator lives in the in-repo `core/core-backend` static-resource server) audited at released build 2.10.26, commit `0a9eaf6af890bbc91ebcd71a8a8013f917846245` (runtime: production `CoreApplication.jar` v2.10.26); th third-party-advisory
https://github.com/dataease/dataease/pull/19566 issue-trackingpatch
https://github.com/dataease/dataease/commit/0709fe98d6608c3507daee3e92cf433e7ff61370 patch
https://github.com/dataease/dataease/releases/tag/v2.10.28 patch
https://github.com/dataease/dataease/ product

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVEs and Security Vulnerabilities - OpenCVE

web:app.opencve.io

Explore the latest vulnerabilities and security issues in the CVE database

2026-11-08 11:20 UTC
October 2026 Critical Patch Update Released | security

web:blogs.oracle.com

For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-08 11:20 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-08 11:20 UTC
Microsoft Patch Tracker (October 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-08 11:20 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:20 UTC
Fixes available for CVE-2026-92392 and other curl vulnerabilities

web:ubuntu.com

Fixes are available in Ubuntu for CVE - 2026 -92392 and the other curl vulnerabilities disclosed on 14 October 2026 .

2026-11-08 11:20 UTC
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-11-08 11:20 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-11-08 11:20 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-08 11:20 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-08 11:20 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-123992.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SVG Handler"
          ],
          "product": "DataEase",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.0"
            },
            {
              "status": "affected",
              "version": "2.10.1"
            },
            {
              "status": "affected",
              "version": "2.10.2"
            },
            {
              "status": "affected",
              "version": "2.10.3"
            },
            {
              "status": "affected",
              "version": "2.10.4"
            },
            {
              "status": "affected",
              "version": "2.10.5"
            },
            {
              "status": "affected",
              "version": "2.10.6"
            },
            {
              "status": "affected",
              "version": "2.10.7"
            },
            {
              "status": "affected",
              "version": "2.10.8"
            },
            {
              "status": "affected",
              "version": "2.10.9"
            },
            {
              "status": "affected",
              "version": "2.10.10"
            },
            {
              "status": "affected",
              "version": "2.10.11"
            },
            {
              "status": "affected",
              "version": "2.10.12"
            },
            {
              "status": "affected",
              "version": "2.10.13"
            },
            {
              "status": "affected",
              "version": "2.10.14"
            },
            {
              "status": "affected",
              "version": "2.10.15"
            },
            {
              "status": "affected",
              "version": "2.10.16"
            },
            {
              "status": "affected",
              "version": "2.10.17"
            },
            {
              "status": "affected",
              "version": "2.10.18"
            },
            {
              "status": "affected",
              "version": "2.10.19"
            },
            {
              "status": "affected",
              "version": "2.10.20"
            },
            {
              "status": "affected",
              "version": "2.10.21"
            },
            {
              "status": "affected",
              "version": "2.10.22"
            },
            {
              "status": "affected",
              "version": "2.10.23"
            },
            {
              "status": "affected",
              "version": "2.10.24"
            },
            {
              "status": "affected",
              "version": "2.10.25"
            },
            {
              "status": "affected",
              "version": "2.10.26"
            },
            {
              "status": "affected",
              "version": "2.10.27"
            },
            {
              "status": "unaffected",
              "version": "2.10.28"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "lucasg2g (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: \"The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T17:15:11.181Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432071 | DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432071"
        },
        {
          "name": "VDB-432071 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432071/cti"
        },
        {
          "name": "CVE-2026-123992 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123992"
        },
        {
          "name": "Submit #1035492 | FIT2CLOUD DataEase (the vulnerable SVG validator lives in the in-repo `core/core-backend` static-resource server) audited at released build 2.10.26, commit `0a9eaf6af890bbc91ebcd71a8a8013f917846245` (runtime: production `CoreApplication.jar` v2.10.26); th",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1035492"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/dataease/dataease/pull/19566"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dataease/dataease/commit/0709fe98d6608c3507daee3e92cf433e7ff61370"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dataease/dataease/releases/tag/v2.10.28"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dataease/dataease/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-06T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-06T19:32:12.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123992",
    "datePublished": "2026-11-07T17:15:11.181Z",
    "dateReserved": "2026-11-06T18:26:56.671Z",
    "dateUpdated": "2026-11-07T17:15:11.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}