{"id":"CVE-2021-48014","kind":"vulnerability","aliases":["CVE-2021-48014"],"related":[],"title":"FineReport: unauthenticated path traversal lets attackers write webshells","description":"FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","summary":"FineReport 9.0 has a path traversal flaw in the design_save_svg operation of /WebReport/ReportServer. An unauthenticated attacker can write arbitrary files, including a JSP webshell, and run code on the server.","severity":"critical","cvss":9.8,"epss":0.01669,"exploited":true,"exploited_at":null,"products":[{"name":"FineReport","fixed":[],"affected":"9.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["finereport","java","other","rce","self-hosted","unauthenticated","vendor","webshell"],"not_affected_if":["managed-hosting","not-internet-exposed"],"how_to_check":"Find FineReport 9.x instances (WebReport/ReportServer reachable). Check the WebReport directory and WEB-INF/assets for unexpected or recently changed .jsp or .svg.jsp files, especially the default update.jsp and update1.jsp, which attackers overwrite. Search access logs for POST /WebReport/ReportServer with op=svginit, cmd=design_save_svg and '..' in filePath, followed by GETs of new .jsp files.","fix":"No fixed version identified in any source; unknown. Ask FanRuan for a patched build or move to the latest FineReport release (not confirmed). Meanwhile block op=svginit/design_save_svg at a WAF or reverse proxy, remove the default update.jsp and update1.jsp, keep the instance off the internet, and if you find signs of exploitation, rebuild the host and rotate credentials stored on the server.","status":"open","published_at":"2026-10-22T11:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:31+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:32:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FineReport: unauthenticated path traversal lets attackers write webshells","impact":"high","summary":"FineReport 9.0 has a path traversal flaw in the design_save_svg operation of /WebReport/ReportServer. An unauthenticated attacker can write arbitrary files, including a JSP webshell, and run code on the server.","category":"vendor","who_cares":["finereport","java","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker writes a JSP webshell and runs code on the server","analyst_note":"Find the vendor fixed version and a check for webshells or the design_save_svg endpoint; see https://nvd.nist.gov/vuln/detail/CVE-2021-48014","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000476,"input_tokens":3025,"output_tokens":347,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor fixed version and a check for webshells or the design_save_svg endpoint; see https://nvd.nist.gov/vuln/detail/CVE-2021-48014","search":"'-10':121C '-14':122C '-2021':10A,13A '-48014':11A,14A '/webreport/reportserver':40B,67C '2023':120C '9.0':27B,59C 'achiev':106C 'allow':73C 'arbitrari':46B,78C 'attack':6A,43B,75C,84C 'code':54B,108C 'contain':60C 'content':98C 'cve':9A,12A 'design':35B,68C 'directori':91C 'evid':111C 'execut':109C 'exploit':110C 'file':47B,79C 'filepath':82C,95C 'finereport':1A,15A,16B,26B,58C 'first':113C 'flaw':32B 'foundat':118C 'host':22B 'includ':48B 'java':17B 'jsp':50B,103C 'let':5A 'observ':114C 'oper':38B,71C 'paramet':83C 'path':3A,30B,62C 'payload':99C 'post':88C 'rce':19B 'remot':107C 'request':89C 'run':53B 'save':36B,69C 'self':21B 'self-host':20B 'send':86C 'sequenc':93C 'server':57B 'shadowserv':117C 'svg':37B,70C 'travers':4A,31B,63C,92C 'unauthent':2A,23B,42B,74C 'vendor':24B 'via':80C 'vulner':64C 'webshel':8A,25B,51B,104C 'write':7A,45B,77C,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2021-48014","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48014","severity":null,"published_at":"2026-10-22T11:17:04+00:00","modified_at":"2026-10-23T22:16:51+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-48014:213","url":null,"severity":null,"published_at":"2026-10-23T22:24:10+00:00","modified_at":"2026-10-23T22:24:10+00:00","first_seen_at":"2026-10-23T22:24:10+00:00","fetched_at":"2026-10-23T22:24:10+00:00","note":"No vendor (FanRuan) advisory or fixed version found; CVE.org and GHSA list only 'affected at 9.0', patched unknown. CVE record cites Shadowserver exploitation first seen 2023-10-14 (I did not read Shadowserver's own data). Public PoC: nuclei template; bug public since 2021 (rce.moe analysis). Severity left critical (CVSS 9.8 v3.1 / 9.3 v4.0). X: 1 post in 7d, nothing worth saving."},{"source":"analyst","external_id":"CVE-2021-48014:246","url":null,"severity":null,"published_at":"2026-10-23T22:32:40+00:00","modified_at":"2026-10-23T22:32:40+00:00","first_seen_at":"2026-10-23T22:32:40+00:00","fetched_at":"2026-10-23T22:32:40+00:00","note":"Return visit: no new sources or documents. how-to-check and fix had reverted to unknown, so I restored them from run 213. Still no vendor advisory or fixed version found; CVE.org and GHSA list only 'affected at 9.0'."},{"source":"epss","external_id":"CVE-2021-48014","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48014","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1427,"url":"https://www.cve.org/CVERecord?id=CVE-2021-48014","title":"CVE Record: CVE-2021-48014","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1417,"url":"https://www.ionix.io/threat-center/cve-2021-48014/","title":"IONIX: CVE-2021-48014 FineReport 9","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1421,"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml","title":"nuclei template: FineReport v9 file overwrite","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1423,"url":"https://rce.moe/2021/05/20/fanruanupload/","title":"FineReport v9 upload analysis (2021)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}