CVE-2026-65690
High
Description
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Syncfusion Standalone Report Designer
PublishedJul 23, 2026
First seenJul 23, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- syncfusion standalone_report_designer14.1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| syncfusion standalone_report_designer | 6.3 ≤ v < 14.1.12 | 14.1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.