SYS::ONLINE
Wasteland.
Briefs1521
Issues20
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-65689 2026-07-23

CVE-2026-65689: Unauthenticated Arbitrary File Read in Bold Reports Standalone Report Designer

"A critical path traversal flaw in Bold Reports Standalone Report Designer lets unauthenticated attackers read arbitrary files from the server, including credentials that grant full application access."

A critical path traversal flaw in Bold Reports Standalone Report Designer lets unauthenticated attackers read arbitrary files from the server, including credentials that grant full application access.

What Is It

CVE-2026-65689 is a missing filepath validation vulnerability (CWE-22, path traversal) in the database download feature of Bold Reports Standalone Report Designer, developed by Bold Reports (by Syncfusion). By supplying a crafted request, an unauthenticated attacker can traverse the filesystem and read arbitrary files from the server. The flaw carries a CVSS 3.1 base score of 9.8 (Critical) with a network attack vector, low attack complexity, and no privileges or user interaction required.

Why It Matters

Because the vulnerability is remotely exploitable without authentication, an attacker only needs network access to the application to abuse it. The advisory notes that the arbitrary file read can disclose sensitive server files, including authentication credentials; meaning a successful read chain can escalate into full unauthorized access to the application itself. The high confidentiality, integrity, and availability impacts reflected in the CVSS vector underscore that this is not merely an information leak but a foothold for complete compromise.

What's Vulnerable

All versions of Bold Reports Standalone Report Designer prior to 14.1.12 are affected. The weakness resides specifically in the product's database download feature, where user-supplied file paths are not validated before being served back to the requester.

Patch Status

The issue is fixed in version 14.1.12. Organizations running any earlier release should upgrade to 14.1.12 or later, per the vendor's release history. At the time of this record, the CVE is listed by NVD as "Undergoing Analysis," and no CISA KEV entry confirming active exploitation was supplied.

Sources