Path Traversal Vulnerability in Bold Reports Standalone Report Designer
CVE-2026-65690

8.7HIGH

Key Information:

Vendor

Bold Reports (by Syncfusion)

Status
Standalone Report Designer
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65690?

The Bold Reports Standalone Report Designer before version 14.1.12 is vulnerable to a missing filepath validation issue in its file upload feature. This flaw can be exploited by authenticated attackers to manipulate file paths and potentially execute arbitrary commands on the server. By providing specially crafted filenames, attackers are capable of traversing outside the designated directories, which could lead to unauthorized access and control over sensitive server functionalities.

Affected Version(s)

Standalone Report Designer 0

References

https://www.boldreports.com/resources/release-history/sta...
release-notes
https://www.vulncheck.com/advisories/bold-reports-standal...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sina Kheirkhah (SinSinology) of watchTowr (watchTowrCyber)
.