CVE-2026-65690: high-severity vulnerability in Bold Reports (By SyncFusion) Standalone Report…
Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.9%
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Bold Reports (By SyncFusion) · Standalone Report DesignerRelated CVEs — Bold Reports (By SyncFusion) Standalone Report…
In the same product, most dangerous first.
CVE-2026-65689CRITICALBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database DownloadEPSS 0.9%CVE-2026-65688CRITICALBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font ProcessingEPSS 0.9%CVE-2026-65687CRITICALBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG ProcessingEPSS 0.9%