CVE-2026-65689
Bold Reports Standalone Report Designer 14.1.12 Arbitrary File Read via Database Download
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application.
| CWE | CWE-22 |
| Vendor | bold reports (by syncfusion) |
| Product | standalone report designer |
| Published | Jul 23, 2026 |
| Last Updated | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for bold reports (by syncfusion) standalone report designer
Be the first to know when new critical vulnerabilities affecting bold reports (by syncfusion) standalone report designer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Bold Reports (By SyncFusion) / Standalone Report Designer
0 < 14.1.12
References
Credits
Sina Kheirkhah (SinSinology) of watchTowr (watchTowrCyber)