Summary
generated automatically from NVD dataFineReport 9.0 has a path traversal flaw (CWE-22) in the design_save_svg operation of /WebReport/ReportServer. An unauthenticated attacker can send a POST request with directory traversal sequences in the filePath parameter and a __CONTENT__ payload to write arbitrary files, such as a JSP webshell, which can lead to remote code execution. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8, and the NVD description notes that the Shadowserver Foundation first observed exploitation evidence on 2023-10-14.
NVD description
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 oct. 2026
- Updated
- 22 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.