---
id: "CVE-2021-48014"
kind: "vulnerability"
aliases: ["CVE-2021-48014"]
title: "FineReport: unauthenticated path traversal lets attackers write webshells"
severity: "critical"
cvss: 9.8
epss: 0.01669
exploited: true
status: "open"
category: "vendor"
products: [{"name": "FineReport", "fixed": [], "affected": "9.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["finereport", "java", "other", "rce", "self-hosted", "unauthenticated", "vendor", "webshell"]
not_affected_if: ["managed-hosting", "not-internet-exposed"]
published_at: "2026-10-22T11:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48014", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:24:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:32:40+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48014", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# FineReport: unauthenticated path traversal lets attackers write webshells

FineReport 9.0 has a path traversal flaw in the design_save_svg operation of /WebReport/ReportServer. An unauthenticated attacker can write arbitrary files, including a JSP webshell, and run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FineReport affected 9.0 fixed ?

## How to check

Find FineReport 9.x instances (WebReport/ReportServer reachable). Check the WebReport directory and WEB-INF/assets for unexpected or recently changed .jsp or .svg.jsp files, especially the default update.jsp and update1.jsp, which attackers overwrite. Search access logs for POST /WebReport/ReportServer with op=svginit, cmd=design_save_svg and '..' in filePath, followed by GETs of new .jsp files.

## Fix

No fixed version identified in any source; unknown. Ask FanRuan for a patched build or move to the latest FineReport release (not confirmed). Meanwhile block op=svginit/design_save_svg at a WAF or reverse proxy, remove the default update.jsp and update1.jsp, keep the instance off the internet, and if you find signs of exploitation, rebuild the host and rotate credentials stored on the server.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48014
- 2026-10-23T22:24:10+00:00 analyst — No vendor (FanRuan) advisory or fixed version found; CVE.org and GHSA list only 'affected at 9.0', patched unknown. CVE record cites Shadowserver exploitation first seen 2023-10-14 (I did not read Shadowserver's own data). Public PoC: nuclei template; bug public since 2021 (rce.moe analysis). Severity left critical (CVSS 9.8 v3.1 / 9.3 v4.0). X: 1 post in 7d, nothing worth saving.
- 2026-10-23T22:32:40+00:00 analyst — Return visit: no new sources or documents. how-to-check and fix had reverted to unknown, so I restored them from run 213. Still no vendor advisory or fixed version found; CVE.org and GHSA list only 'affected at 9.0'.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48014

## Documents

- [advisory] CVE Record: CVE-2021-48014 https://www.cve.org/CVERecord?id=CVE-2021-48014
- [describes] IONIX: CVE-2021-48014 FineReport 9 https://www.ionix.io/threat-center/cve-2021-48014/
- [describes] FineReport v9 upload analysis (2021) https://rce.moe/2021/05/20/fanruanupload/
- [poc] nuclei template: FineReport v9 file overwrite https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml

## From the sources

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_