Which versions of Bold Reports are affected by CVE-2026-65689?

Bold Reports Standalone Report Designer (versions before 14.1.12) exposes organizations to immediate credential theft and account takeover via a remote, unauthenticated file-reading vulnerability.. A patch is available.

How to fix or mitigate CVE-2026-65689?

Within 24 hours: Conduct emergency inventory of all Bold Reports Standalone Report Designer deployments; confirm versions in use and identify systems with internet exposure or access to sensitive data; document current database configurations. Within 7 days: Deploy interim protections including network-level access restrictions via firewall rules and Web Application Firewall (WAF) policies, restrictive file system permissions on host servers, and enhanced monitoring/logging to detect exploitation attempts. Within 30 days: Confirm patch availability and timeline from Syncfusion for version 14.1.12 or later; test upgrades in staging environments; schedule and execute production upgrades across all affected systems; re-scan to verify vulnerability remediation.

Bold Reports CVE-2026-65689

Q: What is the CVSS score of CVE-2026-65689?

CVE-2026-65689 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-48280 CRITICAL

Path Traversal (CWE-22)

2026-07-23 disclosure@vulncheck.com

GHSA-qw66-8h8f-7phh

Authentication Bypass Path Traversal Standalone Report Designer Syncfusion

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network path traversal yields arbitrary file read, so C:H; the primitive itself does not modify or deny service, so I:N/A:N despite downstream credential misuse.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 15:18 EUVD

Analysis Generated

Jul 23, 2026 - 14:32 vuln.today

CVE Published

Jul 23, 2026 - 14:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application.

AnalysisAI

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the host through a path traversal flaw in the database download feature. Because readable files can include stored authentication credentials, a single crafted request can escalate to full unauthorized access to the application. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and zero-precondition attack surface make this a high-priority patch.

Technical ContextAI

Bold Reports is a commercial embedded business-intelligence and reporting suite from Syncfusion/Bold; the affected component is the Standalone Report Designer, the self-hosted desktop/server application used to author and manage reports. The vulnerability is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal') weakness: the database download endpoint accepts a filename/path parameter and fails to canonicalize or validate it against an allowed base directory. As a result, sequences such as ../ (or absolute paths) let the request escape the intended data directory and reference arbitrary filesystem locations, which the server then returns to the caller. The tags 'Path Traversal' and 'Authentication Bypass' reflect that the read itself needs no credentials and that disclosed secrets (e.g., config files holding DB or app credentials) can then be replayed to bypass authentication entirely.

RemediationAI

Upgrade to Bold Reports Standalone Report Designer 14.1.12 or later, which contains the vendor fix (Vendor-released patch: 14.1.12); see the release notes at https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12 and the advisory at https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-database-download. If immediate patching is not possible, restrict network reachability of the Report Designer to trusted management networks or place it behind a VPN/reverse proxy, and block or filter requests to the database download endpoint containing traversal sequences (../, encoded %2e%2e, or absolute paths) at a WAF - noting that filter-based blocking can be bypassed with alternate encodings and may break legitimate downloads, so it is a stopgap only. Because credentials in config files may already be exposed, rotate any application, database, and service credentials stored on affected hosts after upgrading.