{"id":"CVE-2021-48014","published":"2026-10-22T11:17:04.390","lastModified":"2026-10-23T22:16:51.227","description":"FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py","tags":[]},{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%20V9%20design_save_svg%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%A6%86%E7%9B%96%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml","tags":[]},{"url":"https://www.fanruan.com/en/finereport","tags":[]},{"url":"https://www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file-write-via-reportserver","tags":[]}],"exploitRefs":[{"url":"https://github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py","tags":[]},{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%20V9%20design_save_svg%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%A6%86%E7%9B%96%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"FineReport 9.0 has a path traversal flaw (CWE-22) in the unauthenticated /WebReport/ReportServer/design_save_svg endpoint, allowing attackers to write arbitrary files—including JSP webshells—by injecting directory traversal sequences in the filePath parameter, leading to remote code execution.","exploitability":"Exploitation is trivial for unauthenticated attackers due to lack of authentication, no input sanitization on filePath, and publicly available proof-of-concept exploits.","blast_radius":"Successful exploitation grants full system compromise (RCE) with no user interaction required, enabling data theft, lateral movement, or persistent backdoor access across the affected reporting server and potentially connected systems.","remediation":"Upgrade to FineReport version 10.0 or later, as the vendor confirmed the vulnerability is fixed starting in that release; until then, disable the design_save_svg endpoint or restrict network access to it via firewall rules.","detection":"Look for POST requests to /WebReport/ReportServer containing filePath parameters with %2e%2e or .. sequences and a __CONTENT__ field with JSP code (e.g., <%@ page ... %>), especially from unauthenticated sources; also monitor for unexpected .jsp file creation under the web root or report server directories.","tags":["rce","path-traversal","webapp","unauthenticated","jsp-webshell"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:56:56.238Z"}}