CVE-2026-65690 Bold Reports (By SyncFusion) CVE debrief

Who should care

Administrators and users of Bold Reports Standalone Report Designer, especially those who have not updated to version 14.1.12 or later, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing system configurations, restricting access to the DataHub module, and implementing additional security controls to detect and prevent path traversal attacks. Security teams should prioritize patching and vulnerability management for this product, given its potential impact on system security.

Technical summary

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. This module's introduction expanded the attack surface, and defenders should be aware of this change when assessing potential exposure.

Defensive priority

Authenticated attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server, indicating a high level of urgency for mitigation.

Recommended defensive actions

• Apply the vendor-provided patch to update to version 14.1.12 or later
• Restrict access to the DataHub module to only trusted users
• Monitor for suspicious file upload activity
• Implement additional security controls to detect and prevent path traversal attacks
• Review and update the configuration of the Standalone Report Designer to ensure it is properly secured
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected. The NVD entry is currently Analyzed. Further verification is needed to confirm the scope of affected deployments and to assess potential exposure. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Official resources