CVE-2026-75979: Improper Neutralization of Special Elements Used in a Template Engine in xianrendzw EasyReport

CVE-2026-75979 is a vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta affecting the execSqlText/previewSqlText function in DesignerController.java within the SQL Preview Endpoint. The vulnerability arises from improper neutralization of special elements used in a template engine when processing the sqlText argument, enabling remote attackers to potentially execute unauthorized actions. The vulnerability is classified under CWE-791 (Improper Neutralization of Special Elements used in a Template Engine). The project was notified early but has not issued a fix or response. Public exploit code is available, but no known active exploitation has been reported.

The vulnerability allows remote attackers to manipulate SQL preview functionality by injecting specially crafted sqlText, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score of 6.3 reflects a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and unchanged scope.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the SQL Preview Endpoint to trusted users only and applying network-level controls to limit exposure. Review and harden template engine usage and input validation if possible.