CVE-2026-65690

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-65690
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12 Release Notes
https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:syncfusion:standalone_report_designer:*:*:*:*:*:*:*:*
History

28 Jul 2026, 15:55

Type Values Removed Values Added
First Time Syncfusion
Syncfusion standalone Report Designer
CPE cpe:2.3:a:syncfusion:standalone_report_designer:*:*:*:*:*:*:*:*
References () https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12 - () https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12 - Release Notes
References () https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload - () https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload - Third Party Advisory

24 Jul 2026, 15:19

Type Values Removed Values Added
Summary (en) Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. (en) Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

23 Jul 2026, 14:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-23 14:18

Updated : 2026-07-28 15:55

NVD link : CVE-2026-65690

Mitre link : CVE-2026-65690

CVE.ORG link : CVE-2026-65690

JSON object : View

Products Affected

syncfusion

  • standalone_report_designer
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')