Unauthenticated RCE Vulnerability in FineReport 9.0 Allows Webshell Upload

FanRuan FineReport 9.0 contains a critical security flaw that allows unauthenticated attackers to execute arbitrary code on affected systems. The vulnerability, identified as CVE-2021-48014, enables remote attackers to write files to the server by manipulating specific request parameters.

The flaw is classified as a path traversal vulnerability with a CVSS score of 9.3, indicating severe risk. According to the National Vulnerability Database record, the issue stems from improper handling of the filePath parameter within the /WebReport/ReportServer design_save_svg operation. Attackers can exploit this by sending a POST request containing directory traversal sequences.

Exploitation Mechanics and Evidence

Exploitation of this vulnerability involves sending a crafted POST request to the vulnerable endpoint. The attacker includes directory traversal sequences in the filePath parameter alongside a __CONTENT__ payload. This combination allows the attacker to write arbitrary files to the server's file system.

A common goal for such attacks is uploading a JSP webshell. Once uploaded, the webshell provides the attacker with remote code execution capabilities on the host machine. The National Vulnerability Database lists the weakness category as CWE-22, which corresponds to path traversal errors.

Evidence of active exploitation was first observed by the Shadowserver Foundation on October 14, 2023. This observation indicates that the vulnerability has been targeted in the wild. The presence of exploitation evidence underscores the urgency for organizations to assess their exposure to this specific flaw.

Affected Software and Context

The vulnerability specifically affects FanRuan FineReport version 9.0. Organizations using this version of the reporting tool are at risk if the application is accessible to unauthenticated users. The ability to write arbitrary files without authentication makes this a high-priority issue for security teams.

This incident highlights the ongoing risks associated with file upload and path handling in web applications. Similar issues have been found in other tools, such as the awsdac CLI, as Threat Times reported on October 22, 2026. That earlier report detailed a Zip Slip vulnerability allowing arbitrary code execution when processing untrusted files.

The critical nature of CVE-2021-48014 means that even brief exposure can lead to full system compromise. Security professionals should prioritize identifying instances of FineReport 9.0 in their environments. Immediate assessment is recommended given the public availability of exploitation evidence.

What should you do?

Organizations should verify whether they are running FanRuan FineReport 9.0 or other vulnerable versions. If the software is in use, security teams should restrict network access to the application. Limiting access to trusted IP addresses can reduce the attack surface while a permanent solution is sought.

Administrators should monitor web server logs for unusual POST requests to the design_save_svg endpoint. Look for requests containing directory traversal sequences or suspicious file paths. Early detection of these attempts can help mitigate potential breaches before they occur.

What to Do

• Inventory all installations of FanRuan FineReport to confirm version numbers and patch status.
• Restrict network access to FineReport servers to trusted internal networks only.
• Monitor server logs for POST requests containing directory traversal sequences.
• Prepare to isolate affected systems if unauthorized file writes are detected.