---
id: CVE-2021-48014
title: FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
summary: >-
  FineReport 9.0 contains a path traversal vulnerability in the
  /WebReport/ReportServer design_save_svg operation that allows unauthenticated
  attackers to write arbitrary files via the filePath parameter. Attackers can
  send a POST request …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: FanRuan
product: FineReport
affected:
  - FineReport 9.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:29.782Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-48014'
references:
  - url: 'https://github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py'
    label: GitHub Python Script
  - url: >-
      https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%20V9%20design_save_svg%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%A6%86%E7%9B%96%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
    label: PeiQi Wiki GitHub Exploit
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml
    label: Nuclei Template
  - url: 'https://www.fanruan.com/en/finereport'
    label: Product Webpage
  - url: >-
      https://www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file-write-via-reportserver
    label: >-
      VulnCheck Advisory: FineReport 9.0 Unauthenticated Path Traversal File
      Write via ReportServer
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.343Z'
---

## Overview

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

## Affected

- `FineReport 9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.