CVE-2026-123992 | DataEase up to 2.10.27 SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting (ID 19566)

A vulnerability, which was classified as problematic, was found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting.

This vulnerability is registered as CVE-2026-123992. It is possible to launch the attack remotely. Furthermore, an exploit is available.

You should upgrade the affected component.

The vendor confirms: “The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses.”VulDB Recent EntriesRead More