Which versions of Bold Reports are affected by CVE-2026-65688?

Bold Reports Standalone Report Designer (CVE-2026-65688, CVSS 9.3) contains a critical vulnerability allowing unauthenticated attackers to read arbitrary files from the server, including stored…. A patch is available.

How to fix or mitigate CVE-2026-65688?

Within 24 hours, immediately inventory all Bold Reports Standalone Report Designer deployments and confirm which systems run versions before 14.1.12; isolate affected instances from production networks or restrict access through firewall rules to authorized internal administrators only. Within 7 days, implement compensating controls including Web Application Firewall (WAF) rules to block font-processing feature exploitation, rotate all stored credentials (database passwords, API keys, authentication tokens) within the application, and monitor server and application logs for exploitation attempts. Within 30 days, monitor Bold Reports vendor advisories for patch availability; upon release of version 14.1.12 or later, plan and execute upgrades in test environments first, validate patch effectiveness, then deploy to production systems.

Bold Reports CVE-2026-65688

Q: What is the CVSS score of CVE-2026-65688?

CVE-2026-65688 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-48279 CRITICAL

Path Traversal (CWE-22)

2026-07-23 disclosure@vulncheck.com

GHSA-mx5r-8grf-ph62

Authentication Bypass Path Traversal Standalone Report Designer Syncfusion

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable file read with no user interaction (AV:N/AC:L/PR:N/UI:N); direct impact is confidentiality only (C:H), with I/A:N since the primitive reads but does not write or deny service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 15:18 EUVD

Analysis Generated

Jul 23, 2026 - 14:30 vuln.today

CVE Published

Jul 23, 2026 - 14:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application.

AnalysisAI

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers traverse the filesystem via the font-processing feature and retrieve any file the service account can access. Because readable files include stored authentication credentials, a successful read can be pivoted into full unauthorized access to the application. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV, but the CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

Bold Reports Standalone Report Designer is a self-hosted reporting/BI design tool from Syncfusion/Bold Reports used to author and manage reports. The flaw is a classic CWE-22 path traversal: the font-processing feature accepts an attacker-supplied filepath and fails to validate or canonicalize it before opening the target, so traversal sequences (e.g. ../../) escape the intended font directory and resolve to arbitrary locations on the host. This is a missing-input-validation defect in server-side file handling rather than a memory-safety or injection issue; the read primitive returns file contents to the requester, and its severity is amplified because the application's own credential/configuration files live on the same filesystem.

RemediationAI

Vendor-released patch: 14.1.12 - upgrade Bold Reports Standalone Report Designer to 14.1.12 or later as documented in the vendor release history (https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12) and the VulnCheck advisory (https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-font-processing). Until the upgrade is applied, restrict network exposure of the designer service by placing it behind a VPN or firewall so it is not internet-reachable, and put a reverse proxy or WAF rule in front to block requests containing path-traversal sequences (../, encoded %2e%2e, and absolute-path indicators) targeting the font-processing endpoint - with the trade-off that WAF filtering can be bypassed by novel encodings and is only a stopgap. Because the flaw can disclose authentication credentials, rotate any secrets, application credentials, and connection strings that may have resided on the host after patching, since exposure cannot be ruled out once the service was reachable.