FineReport 9.0 includes a path‑traversal flaw in the /WebReport/ReportServer design_save_svg endpoint. An unauthenticated attacker can craft a POST request that supplies a filePath containing directory traversal sequences and a __CONTENT__ payload. The server writes the payload to the attacked path, allowing the attacker to place arbitrary files, such as a JSP web shell, and execute code under the web server's privileges. The vulnerability is a classic path‑traversal weakness and is classified as CWE‑22.

FanRuan FineReport 9.0 is affected. No additional product or minor‑release details are provided; the vulnerability applies to any installation running version 9.0 that exposes the design_save_svg operation.

The issue scores a CVSS score of 9.3, indicating critical severity. Although EPSS data is not available, the Shadowserver Foundation documented exploitation in October 2023, confirming that attackers can exploit the flaw. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, the attack surface is large; an attacker only needs unauthenticated HTTP access to the vulnerable endpoint to perform the file write and achieve remote code execution.