CVE-2026-102755 dataease CVE debrief

Who should care

Defenders responsible for DataEase deployments should assess exposure and prioritize upgrading to version 2.10.26 or later. They should also monitor user interactions with the Move to dialog and ensure that user input is properly sanitized.

Why it matters

CVE-2026-102755 is a stored XSS vulnerability in DataEase that allows authenticated users to store HTML-bearing names, which can be executed as JavaScript when another user interacts with the Move to dialog. Defenders should prioritize upgrading to version 2.10.26 or later and ensure user input is properly sanitized.

• Execution of attacker-controlled JavaScript in victim's DataEase session
• Potential for unauthorized actions within DataEase
• Need for verification of user input sanitization
• Priority for upgrading to fixed version 2.10.26

Technical summary

The vulnerability exists in the DataEase tool, specifically in the datasource and dataset Move to dialogs. Authenticated users with folder creation permissions can store HTML-bearing names, which can be executed as JavaScript when another user interacts with the Move to dialog. The issue is fixed in version 2.10.26. The vulnerability allows for execution of attacker-controlled JavaScript in victim's DataEase session, potential for unauthorized actions within DataEase, and need for verification of user input sanitization.

Defensive priority

Defenders should prioritize upgrading to version 2.10.26 or later to prevent exploitation. They should also monitor user interactions with the Move to dialog and ensure that user input is properly sanitized.

Recommended defensive actions

• Upgrade to version 2.10.26 or later
• Monitor user interactions with the Move to dialog
• Ensure user input is properly sanitized
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The NVD entry is currently not provided. The vulnerability allows authenticated users to store HTML-bearing names, which can be executed as JavaScript when another user interacts with the Move to dialog. The issue is fixed in version 2.10.26. There are no known instances of exploitation, but defenders should verify user input sanitization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.