Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CRITICAL: CVE-2026-65688 (CVSS 9.8) Bold Reports Standalone Report Designer <14[.]1[.]12 allows unauthenticated path traversal via font processing. Attackers can read arbitrary files including credentials. Patch immediately to v14[.]1[.]12+ #CVE #PatchNow https://t.co/pxzQMF1FS4
Post summary
The tweet announces CVE-2026-65688, details a path traversal flaw, and urges immediate patching to version 14.1.12+.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | syncfusion | standalone_report_designer | - | - | - |