CVE-2021-48014 in FineReport
Summary
by MITRE • 10/22/2026
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
FineReport version 9.0 is susceptible to a critical path traversal vulnerability within its design_save_svg operation, located at the /WebReport/ReportServer endpoint. This flaw stems from insufficient validation of user-supplied input in the filePath parameter, allowing unauthenticated attackers to manipulate file system paths through directory traversal sequences such as dot-dot-slash constructs. The vulnerability enables remote code execution by permitting the writing of arbitrary files to locations accessible by the web server, effectively bypassing intended access controls and security boundaries designed to restrict write operations to specific directories.
The technical mechanism involves sending a POST request where the filePath parameter is crafted with traversal characters to escape the designated upload directory. By appending malicious content within the _CONTENT_ payload field, an attacker can inject executable script code directly onto the server's file system. This capability allows for the creation of JSP webshells or other executable scripts in directories that are processed by the application server, thereby granting the attacker full control over the underlying operating system through remote command execution capabilities inherent to these script types.
Operational impact is severe as this vulnerability facilitates complete compromise of the affected FineReport instance without requiring any form of authentication. Once a webshell is successfully deployed and accessed via HTTP requests, attackers can execute arbitrary commands, exfiltrate sensitive data stored within the reporting environment, pivot into internal networks if the server has broader connectivity, or establish persistent backdoors for long-term access. The presence of this vulnerability significantly increases the attack surface for organizations relying on FineReport for business intelligence and reporting services, potentially leading to significant data breaches and operational disruption.
Exploitation evidence was first observed by the Shadowserver Foundation on October 14, 2023, indicating active exploitation in the wild shortly after public disclosure or awareness of the flaw. This real-world activity underscores the urgency for immediate remediation efforts across all deployments running FineReport version 9.0 that are exposed to untrusted networks or the internet. The lack of authentication requirements makes this vulnerability particularly dangerous as it can be exploited by automated scanning tools and opportunistic attackers with minimal effort, leading to widespread compromise if left unpatched.
Mitigation strategies should prioritize immediate application of vendor-provided patches or updates that address the input validation flaws in the design_save_svg operation. In cases where patching is not immediately feasible, network-level controls such as web application firewalls can be configured to block requests containing directory traversal patterns within the filePath parameter. Additionally restricting access to the /WebReport/ReportServer endpoint through IP whitelisting or strong authentication mechanisms can reduce exposure until a permanent fix is implemented. Regular security audits and monitoring for unusual file system changes in web-accessible directories are also recommended to detect potential exploitation attempts early.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which classifies improper limitation of a pathname to a restricted directory, commonly known as path traversal. From an offensive perspective, the attack vector corresponds to ATT&CK technique T1505.003, involving server-side web shell deployment via file upload mechanisms. Understanding these mappings helps in categorizing the risk within broader security frameworks and ensures that defensive measures are aligned with industry-standard threat models for preventing unauthorized code execution through input manipulation flaws.