DataEase is an open source data visualization and analysis tool. Prior to version 2.10.23, the platform allowed authenticated users to submit TemplateManageRequest.staticResource via POST /de2api/templateManage/save or through the DataVisualizationServer.decompression endpoint. The server then decoded the Base64‑encoded SVG content and wrote it to /de2api/static-resource/<name>.svg without validating the file extension, MIME type, decoded bytes, or whether the SVG was scriptable. Consequently, malicious SVG files could be stored and later served to other authenticated users, triggering stored same‑origin cross‑site scripting. The vulnerability is fixed in version 2.10.23.

All installations of DataEase version 2.10.22 or earlier are vulnerable. The flaw resides in the StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe handlers, which are triggered by authenticated requests to /de2api/templateManage/save or the decompression endpoint. Users with permissions to upload templates can create malicious SVG assets that are subsequently served to other authenticated users from the /de2api/static-resource/ directory.

The CVSS score of 6.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers require valid user credentials or a compromised account to upload malicious SVGs, so the risk is confined to environments where such access is possible. Once the malicious asset is stored, it can be triggered by any authorized user who accesses that specific static resource path, potentially leading to user‑level compromise within the organization.