CVE-2026-65688 Bold Reports (By SyncFusion) CVE debrief

Who should care

Administrators and users of Bold Reports Standalone Report Designer, especially those with sensitive data, should be aware of this critical vulnerability and take immediate action to patch their systems. Security teams should review exposure, assess potential impact, and implement compensating controls if necessary. Operators and platform administrators should prioritize updates and monitor for suspicious activity.

Technical summary

The Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature. This allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request, potentially disclosing sensitive server files, including authentication credentials. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Affected deployments should prioritize patching to prevent unauthorized access.

Defensive priority

Immediate attention is required due to the critical severity of this vulnerability, which allows unauthenticated attackers to read arbitrary files from the server filesystem.

Recommended defensive actions

• Apply the vendor-provided patch to update to version 14.1.12 or later
• Restrict access to the DataHub module to authenticated users only
• Monitor server logs for suspicious file access requests
• Implement additional security measures to protect sensitive server files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in Bold Reports Standalone Report Designer before 14.1.12, specifically in the DataHub module introduced in version 6.3. The flaw allows unauthenticated attackers to read arbitrary files by supplying a crafted request, potentially disclosing sensitive server files, including authentication credentials. Evidence is limited to public sources and vendor documentation. Defenders should verify affected deployments, review official advisories, and assess exposure.

Official resources