PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-48014 FanRuan CVE debrief

CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer allows unauthenticated attackers to write arbitrary files via the filePath parameter in the /WebReport/ReportServer design_save_svg operation, potentially leading to remote code execution via JSP webshell. Defenders of FineReport 9.0 instances should assess exposure and verify vulnerability to prioritize remediation efforts and mitigate potential operational impacts. The vulnerability has a CVSS score of 9.3, indicating critical severity.

Vendor
FanRuan
Product
FineReport
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-23
Advisory published
2026-10-22
Advisory updated
2026-10-23

Who should care

Defenders of FineReport 9.0 instances, security teams, and vulnerability management teams should assess exposure and verify vulnerability. Operational impacts may include potential remote code execution via JSP webshell and unauthenticated file write via path traversal. Prioritization of remediation efforts is crucial to mitigate potential operational impacts.

Why it matters

CVE-2021-48014 is a critical vulnerability in FineReport 9.0 that allows unauthenticated attackers to write arbitrary files via path traversal. Defenders should assess exposure, verify vulnerability, and apply remediation if available.

  • Unauthenticated file write via path traversal
  • Potential for remote code execution via JSP webshell

Technical summary

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation. Unauthenticated attackers can write arbitrary files via the filePath parameter, potentially leading to remote code execution via JSP webshell. The vulnerability has a CVSS score of 9.3, indicating critical severity. Defenders should focus on verifying vulnerability and applying remediation if available to mitigate potential operational impacts. Limited source detail suggests focusing on defensive priorities and known exposure.

Defensive priority

High

Recommended defensive actions

  • Assess exposure of FineReport 9.0 instances
  • Verify if instances are vulnerable
  • Apply vendor remediation if available
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Check relevant monitoring and detection logs

Evidence notes

The CVE record and source item provide details on the vulnerability. The Shadowserver Foundation observed exploitation evidence on 2023-10-14. However, the corpus does not provide extensive details on the vulnerability or its impact. Further verification is needed to assess affected scope and vendor guidance. Limited source detail suggests focusing on defensive priorities and known exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-48014 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-48014

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-48014 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-48014

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/48xxx/CVE-2021-48014.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py

    Supplemental source - exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%20V9%20design_save_svg%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%A6%86%E7%9B%96%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md

    Supplemental source - exploit, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9-file-upload.yaml

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.fanruan.com/en/finereport

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file-write-via-reportserver

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.