Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65690Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

High 8.8

In plain English

A high-severity path traversal in Standalone Report Designer from Bold Reports (By SyncFusion). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 40.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

Affected products (as reported)

Vendor	Product	Versions
Bold Reports (By SyncFusion)	Standalone Report Designer	6.37.1.109.110.111.112.113.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload third-party-advisory