CVE-2026-65689Disclosure(syncfusion / standalone_report_designer)

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch syncfusion standalone_report_designer systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

syncfusion CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-database-download

Other references

https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

standalone_report_designer

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 1d ago at 3 mentions (2026-07-23); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

syncfusion

Products

standalone_report_designer

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-23	3	Disclosure2Patch1
2026-08-01	1	Patch1

Full discourse4 posts

Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-65689 — CVSS 9.8/10 ██████████ Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/aRJNNLAfI2
Post summary
The tweet announces a critical missing filepath validation vulnerability (CVE-2026-65689) in Bold Reports Standalone Report Designer pre-14.1.12 and urges users to apply a patch.
1000047
69 followersView on X
DFIR Lab@DFIR_Lab83d
Patch
🚨 CRITICAL: CVE-2026-65689 (CVSS 9.8) Bold Reports Standalone Report Designer <14[.]1[.]12 allows unauthenticated path traversal to read arbitrary files, exposing credentials & enabling full system compromise. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/9z02gSWE02
Post summary
The tweet alerts to a critical CVE-2026-65689 in Bold Reports Standalone Report Designer that permits unauthenticated path traversal, potentially exposing credentials and enabling full system compromise, and urges an immediate patch.
0000059
99 followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-65689 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticat… https://www.cve.org/CVERecord?id=CVE-2026-65689 ----- Traducción: CVE-2026-65689 Bol… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑65689, detailing a missing filepath validation flaw that permits unauthenticated database downloads in Bold Reports Standalone Report Designer prior to v14.1.12. No PoC, exploit code, patch, or active exploitation evidence is provided.
0000031
94 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-65689 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticat… https://www.cve.org/CVERecord?id=CVE-2026-65689
Post summary
The tweet announces a new vulnerability (CVE‑2026‑65689) in Bold Reports Standalone Report Designer, detailing a missing filepath validation flaw that could allow unauthenticated database download.
000001.7K
57.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	syncfusion	standalone_report_designer	-	-	-

Explore more

Back to dashboard syncfusion CVEs standalone_report_designer vulnerabilities

What researchers are saying

CVE-2026-65689

Orizon[verified]@OrizonCyberPatch

The tweet announces a critical missing filepath validation vulnerability (CVE-2026-65689) in Bold Reports Standalone Report Designer pre-14.1.12 and urges users to apply a patch.

DFIR Lab[verified]@DFIR_LabPatch

The tweet alerts to a critical CVE-2026-65689 in Bold Reports Standalone Report Designer that permits unauthenticated path traversal, potentially exposing credentials and enabling full system compromise, and urges an immediate patch.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑65689, detailing a missing filepath validation flaw that permits unauthenticated database downloads in Bold Reports Standalone Report Designer prior to v14.1.12. No PoC, exploit code, patch, or active exploitation evidence is provided.

CVE@CVEnewDisclosure

The tweet announces a new vulnerability (CVE‑2026‑65689) in Bold Reports Standalone Report Designer, detailing a missing filepath validation flaw that could allow unauthenticated database download.