CVE-2026-123992

The DataEase platform, versions up to 2.10.27 , is vulnerable to a Cross-Site Scripting (XSS) flaw within the SVG Handler component. The root cause is located in the StaticResourceServer.validateSvgContent function of the StaticResourceServer.java file. An attacker can perform a remote manipulati...