CVE-2021-48014
FanRuan FineReport
What this is
FineReport does not properly limit where it saves files. An attacker can make it write files outside the intended location.
How it can harm you
An attacker who can reach FineReport over a network can write arbitrary files without signing in. They can use this to run their own program on the server.
How urgent it is
This vulnerability is already being used in attacks. Fixing it matters because an attacker can run their own program on the server without signing in.
Who is affected
FineReport 9.0 is affected. Whether other versions are affected is unknown.
What to do
Consult the vendor advisory from FanRuan for verified remediation. No fixed version or workaround is specified.
How to check your server
Find the installed FineReport version and compare it with the affected versions and remediation guidance in the vendor advisory.
Technical details
- CVE
- CVE-2021-48014
- Published
- October 22, 2026
- CWE
- CWE-22
- CVSS
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 1.7% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.