Vulnerability Description
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Syncfusion | Standalone Report Designer | >= 6.3, < 14.1.12 |
Related Weaknesses (CWE)
References
- https://www.boldreports.com/resources/release-history/standalone-report-designerRelease Notes
- https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbThird Party Advisory
FAQ
What is CVE-2026-65689?
CVE-2026-65689 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary fil...
How severe is CVE-2026-65689?
CVE-2026-65689 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-65689?
Check the references section above for vendor advisories and patch information. Affected products include: Syncfusion Standalone Report Designer.