Which versions of Bold Reports are affected by CVE-2026-65690?

Bold Reports Standalone Report Designer versions before 14.1.12 enable low-privilege authenticated users to execute arbitrary commands with elevated server privileges through a path traversal flaw in…. A patch is available.

How to fix or mitigate CVE-2026-65690?

Within 24 hours, inventory all Bold Reports Standalone Report Designer deployments below version 14.1.12, implement network-level access restrictions on the file-upload endpoint, and disable the upload feature if business requirements permit. Within 7 days, enforce strict server-side filename sanitization to reject path traversal patterns (../, ..\, and equivalents), deploy centralized logging for all file operations with alerts on writes outside the intended reports directory, and apply request signing to file-upload endpoints. Within 30 days, continuously monitor vendor advisories for patch availability targeting version 14.1.12 or later, validate the upgrade path in a test environment, and schedule production deployment with post-patch security validation.

Bold Reports CVE-2026-65690

Q: What is the CVSS score of CVE-2026-65690?

CVE-2026-65690 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-48282 HIGH

Path Traversal (CWE-22)

2026-07-23 disclosure@vulncheck.com

GHSA-42mq-p2mg-jgxc

File Upload Path Traversal Standalone Report Designer

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable upload endpoint (AV:N/AC:L) but requires a valid low-privilege login (PR:L); arbitrary write escalates to command execution giving full C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 15:18 EUVD

Analysis Generated

Jul 23, 2026 - 14:32 vuln.today

CVE Published

Jul 23, 2026 - 14:18 cve.org

HIGH 8.7

DescriptionCVE.org

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server.

AnalysisAI

Remote code execution in Bold Reports Standalone Report Designer before 14.1.12 lets authenticated users abuse the file-upload feature to write files outside the intended directory via a crafted filename, ultimately running arbitrary commands with high privileges on the host. The flaw chains a CWE-22 path traversal into server-side command execution, and per the CVSS 4.0 vector requires only low privileges with no user interaction over the network. No public exploit identified at time of analysis, though a VulnCheck advisory documents the issue.

Technical ContextAI

Bold Reports Standalone Report Designer is a self-hosted reporting/BI authoring application (from the Syncfusion/Bold Reports product line) that exposes a file-upload endpoint for report assets and resources. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'): the upload handler fails to validate or canonicalize the supplied filename, so traversal sequences let an attacker control the write destination outside the sanctioned upload folder. Because the writable location can overlap with executable or web-served content, the arbitrary write is escalated into command execution running under the privileges of the application/service account, which the advisory characterizes as high.

RemediationAI

Upgrade to Bold Reports Standalone Report Designer 14.1.12 or later, which is the vendor-released patch per the Bold Reports release history (https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12); this is the primary and definitive fix. Until the upgrade is applied, reduce exposure by restricting network access to the Report Designer application (place it behind a VPN or IP allowlist and remove any direct internet exposure), and tighten the accounts that can authenticate and reach the file-upload functionality since exploitation requires a valid low-privilege login - trade-off: this limits legitimate remote report authoring. Where feasible, run the application service under a least-privilege account and mount the upload/report directories as non-executable to blunt the write-to-execute escalation, accepting that this does not address the traversal itself. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload) for details.