CVE-2026-65687 | Bold Reports Standalone Report Designer before 14.1.12 conta… | CVSS 9.8 CRITICAL

Description

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

Metadata

CVE ID: CVE-2026-65687
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-22 20:26 UTC
Published: 2026-07-23 13:24 UTC
Last updated: 2026-07-24 14:32 UTC
Primary CWE: CWE-22
Improper Limitation of a Pathname to a Restricted Directory …
Vendor / Product: Bold Reports (By SyncFusion) / Standalone Report Designer
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Bold Reports (By SyncFusion)	Standalone Report Designer	—	6.3, 7.1.10, 9.1, 10.1 …

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)