FanRuan FineReport: Unauthenticated path traversal leading to arbitrary file write
Summary
FineReport 9.0 contains a path traversal flaw in the design_save_svg operation of the /WebReport/ReportServer endpoint. An unauthenticated remote attacker can use directory traversal in the filePath parameter to write arbitrary files, for example a JSP web shell, and thereby achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14, and public proof-of-concept code exists.
Affected
- FanRuan FineReport 9.0
- Other versions: Unknown.
Fixed in
- Unknown. No vendor advisory or fixed build was found; ask FanRuan.
Workaround
- Unknown from vendor sources.
- Restrict network access to the FineReport server; do not expose it to the internet.
- Block or restrict the /WebReport/ReportServer path at a reverse proxy or WAF.
- Check the web root for unexpected .jsp files.
Exploitation
- Exploitation observed in the wild; first seen by Shadowserver on 2023-10-14.
- Public proof of concept available.
- CISA SSVC: exploitation poc, automatable yes, technical impact total.
- CISA KEV status: Unknown; conflicting information found.
Our recommendation
- Inventory all FineReport instances and confirm exact versions.
- Contact FanRuan for the advisory and a fixed build for any 9.x deployment.
- Remove or restrict internet exposure of /WebReport/ReportServer immediately.
- Check for unexpected .jsp files and POST requests to design_save_svg in logs.
- Re-check the CISA KEV catalog and the NVD record, as the NVD status is Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- FanRuan FineReport product page www.fanruan.com
- Nuclei detection template github.com
- Public exploit script (GitHub) github.com
- PeiQi wiki write-up github.com
- Strix CVE record www.strix.ai
- Vulners RAPID7 entry vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:54.
Original description (NVD)
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
NVD references (5)
- https://github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8…
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/fine-report-v9…
- https://www.fanruan.com/en/finereport
- https://www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file-write-via-reportserver
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.