Which versions of Bold Reports are affected by CVE-2026-65687?

Bold Reports Standalone Report Designer versions before 14.1.12 contain a critical unauthenticated file-read vulnerability allowing remote attackers to extract stored credentials and gain full…. A patch is available.

How to fix or mitigate CVE-2026-65687?

Within 24 hours: Immediately identify all Bold Reports Standalone Report Designer installations and determine their versions; restrict network access to affected systems to trusted networks only and disable external connectivity where possible. Within 7 days: Upgrade all instances to Bold Reports Standalone Report Designer version 14.1.12 or later once available; confirm successful upgrades across all deployments. Within 30 days: Conduct a full audit of all credentials that may have been stored in or accessed through affected systems; reset application passwords, database credentials, and API keys that could have been compromised; perform a complete review of system access logs for indicators of unauthorized access during the vulnerability exposure window.

Bold Reports CVE-2026-65687

Q: What is the CVSS score of CVE-2026-65687?

CVE-2026-65687 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-48278 CRITICAL

Path Traversal (CWE-22)

2026-07-23 disclosure@vulncheck.com

GHSA-hcq3-wvr8-3wvg

Authentication Bypass Path Traversal Standalone Report Designer Syncfusion

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network file-read with no user interaction gives AV:N/AC:L/PR:N/UI:N; the primitive discloses files so C:H, while integrity/availability impact is only indirect via stolen credentials, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 15:18 EUVD

Analysis Generated

Jul 23, 2026 - 14:30 vuln.today

CVE Published

Jul 23, 2026 - 14:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application.

AnalysisAI

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the server through a path traversal flaw in the SVG processing feature. Because readable files include stored authentication credentials, an attacker can pivot from file disclosure to full unauthorized access of the application. Disclosed by VulnCheck with a CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Bold Reports is Syncfusion's embedded/standalone reporting and dashboard platform; the affected component is the Standalone Report Designer, a self-hosted web application used to author and render reports. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the SVG processing routine takes an attacker-influenced file path and fails to validate or canonicalize it against an allowed base directory, so traversal sequences (e.g., ../../) resolve to arbitrary locations on the host filesystem. Because the SVG handler is reachable without authentication, the traversal executes in the application's process context and returns file contents to the requester.

RemediationAI

Vendor-released patch: 14.1.12 - upgrade every Bold Reports Standalone Report Designer instance to 14.1.12 or later, per the vendor release history (https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12) and the VulnCheck advisory (https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-svg-processing). Until patching is complete, restrict network exposure of the Report Designer by placing it behind a VPN or IP allowlist and blocking direct internet access to reduce the unauthenticated attack surface; if a reverse proxy or WAF is in front of the application, add rules to reject requests to the SVG processing endpoint that contain traversal sequences or encoded path characters (../, ..%2f, %2e%2e), accepting that aggressive filtering may break legitimate SVG rendering. Because credentials may already be exposed, rotate any application, database, and service credentials stored on or accessible to the host after confirming no prior compromise.