Path Traversal in Fanruan Finereport
CVE-2021-48014
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Fanruan Finereport — versions 9.0
Weakness classification (CWE)
References
- github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py (exploit)
- github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/帆软OA/帆软报表 V9 design_sa… (technical-description, exploit)
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/fin… (technical-description)
- www.fanruan.com/en/finereport (product)
- www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file… (third-party-advisory)
Frequently asked questions
- What is CVE-2021-48014?
- CVE-2021-48014 is a critical-severity vulnerability in Fanruan Finereport, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-10-22.
- How severe is CVE-2021-48014?
- Critical severity. CVSS v3 base score is 9.8 out of 10.