CVE-2021-48014 is a critical, unauthenticated path traversal flaw in FanRuan FineReport 9.0 that lets attackers write arbitrary files, including JSP webshells, and achieve remote code execution.
What Is It
The flaw is a path traversal weakness (CWE-22) in the design_save_svg operation of FineReport's /WebReport/ReportServer endpoint. An attacker sends a POST request with directory traversal sequences in the filePath parameter and a __CONTENT__ payload. This can write attacker-controlled content to arbitrary locations on the server, limited by the file system permissions of the FineReport process. According to the NVD description, attackers can use it to drop a JSP webshell and execute code remotely. The NVD description and CVSS vector indicate that no authentication is required.
VulnCheck disclosed the issue, and NVD published it on 2026-10-22. Its NVD status is currently "Received."
Why It Matters
- Severity: CVSS 3.1 base score is 9.8 (CRITICAL), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (CRITICAL). - Low barrier: The attack works over the network with low complexity, no privileges and no user interaction.
- Exploitation observed: The NVD description says the Shadowserver Foundation first observed exploitation evidence on 2023-10-14, about three years before this CVE was published.
- Public tooling: The NVD references include a public exploit script, a write-up and a Nuclei template, which likely makes opportunistic scanning easier.
- KEV status: The supplied CISA KEV data has no entry for this CVE. KEV does not currently confirm active exploitation, and there is no CISA due date or required action.
What's Vulnerable
- Vendor: FanRuan
- Product: FineReport
- Affected version: 9.0
The NVD record lists no CPE configurations, and the default status for other versions is "unknown." The supplied data does not show whether other versions are affected.
Patch Status
The supplied NVD and KEV data name no fixed version, vendor patch or official workaround. There is no CISA-mandated remediation because the CVE is not in KEV. Organizations running FineReport 9.0 should check the VulnCheck advisory and FanRuan directly for remediation guidance. Exploitation was first observed in 2023, so they should also review exposure of the /WebReport/ReportServer endpoint.