External risk intelligence

Bold Reports Standalone Report Designer Arbitrary File Read via Font Processing

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65688

Bold Reports Standalone Report Designer is a web-based application typically deployed to provide reporting services to users. As a web application, it is commonly exposed to the network to allow remote users to access, design, and manage reports, making its web-accessible endpoints likely to be reachable from the internet.

Path Traversal

Syncfusion Standalone Report Designer

6.3 to before 14.1.12

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Bold Reports Standalone Report Designer has a critical vulnerability that allows unauthenticated attackers to read sensitive files from the server, potentially leading to unauthorized access. This issue stems from how the software processes fonts, where a lack of proper validation on file paths enables attackers to navigate the server's file system. The primary concern is confirming if our environment is exposed and what sensitive information might be at risk.

Unauthenticated file reading flaw in reporting software.
Confirms exposure and sensitive data risk.
Assess relevance and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the Bold Reports Standalone Report Designer, leveraging its font processing feature. Because the application does not properly validate file paths in this feature, the attacker can trick it into reading and returning arbitrary files from the server's filesystem. This could expose sensitive information, such as authentication credentials, potentially allowing the attacker to gain unauthorized access to the application.

No authentication required to access.
Crafted request triggers font processing.
Exposes sensitive files, enabling unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could read arbitrary files from the server filesystem, including authentication credentials, by supplying a crafted request to the font processing feature when supported by the advisory. This could enable full unauthorized access to the application.

Sensitive server files at risk.
Via crafted request to font processing.
Could lead to full unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owners and infrastructure teams are likely responsible for addressing this vulnerability, as it affects a web-based reporting service. The first practical step is to locate all instances of the affected software, confirm their accessibility and criticality, identify the specific teams or individuals accountable for each instance, and then plan remediation actions based on the assessed risk.

Identify application owners and accountable teams.
Verify software location and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Bold Reports Standalone Report Designer?

It is a web-based reporting software used by organizations to create, manage, and share business intelligence reports. Because it serves as a central hub for data visualization, it is frequently installed on servers where it can be accessed by various users across a network to generate documents and analytical dashboards.

What is the vulnerability in CVE-2026-65688?

This vulnerability is classified as a Path Traversal issue (CWE-22). It means the software fails to properly check file paths when handling font files. An attacker can manipulate input to navigate outside of the intended directory, tricking the server into reading and returning files it should keep private, such as configuration files or credential stores.

How do attackers trigger this vulnerability?

An attacker triggers this by sending a specially crafted network request to the application's font processing feature. Because the application does not validate the file path input, the request directs the server to access files on its own filesystem. Simply interacting with standard, legitimate report features that do not involve custom font processing will not inherently trigger this specific security flaw.

Is my Bold Reports instance at risk?

If your instance is accessible over the network or internet, it is at higher risk. According to Halo Surface Signal, this software is commonly deployed as a web application intended for remote user access. If your installation is reachable from the internet, it is likely that an unauthenticated attacker could attempt to exploit this flaw to reach sensitive server files.

How should I respond to CVE-2026-65688?

Your first step is to locate all deployments of the software within your environment and determine who owns or manages each instance. Verify which servers are reachable from the network and prioritize those for updates. Ensure you are aware of the official vendor release history to apply the required version fix, which resolves the file path validation issue entirely.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.