CVEFinder.io

CVE-2026-65690

⚠️ high
🔍 Scan for this CVE
Summary

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 ar

Description

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

CVSS Score
8.8
High
EPSS Score
0.6
Exploit Probability
Published Date
2026-07-23
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.0% of all 340,405 vulnerabilities in our database.

#64,719
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 23, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Sina Kheirkhah (SinSinology) of watchTowr (watchTowrCyber)
SSVC data provided by CISA
Last Modified 2026-07-28
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-22

📦 Affected Products 1

Vendor Product Status Affected Versions
syncfusion standalone_report_designer Affected
≥ 6.3 < 14.1.12

🔗 References 2

https://www.boldreports.com/resources/release-histor...
Release Notes
https://www.vulncheck.com/advisories/bold-reports-st...
Third Party Advisory

🔗 Related CVEs 3

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-65687 ⛔ critical 9.8 0.6 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG p... 2026-07-23
CVE-2026-65688 ⛔ critical 9.8 0.6 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font ... 2026-07-23
CVE-2026-65689 ⛔ critical 9.8 0.6 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its datab... 2026-07-23
These CVEs affect the same products