External risk intelligence

Bold Reports Designer Arbitrary File Read via Database Download.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65689

The product is a standalone web-based reporting and design application. Such tools are commonly deployed as internet-facing or externally reachable web services to allow users to design, manage, and access reports remotely, placing the database download and file-handling features in a position where they are often reachable via the public internet.

Path Traversal

Syncfusion Standalone Report Designer

6.3 to before 14.1.12

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Bold Reports Standalone Report Designer, a tool used for creating and managing reports. The issue allows unauthenticated attackers to read sensitive files from the server, potentially including credentials, which could lead to unauthorized access to the application.

Attackers can read server files without logging in.
Matters for applications handling sensitive data.
Confirm relevance; assess potential access risks.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the reporting tool over the network. This request targets a feature that downloads database files, but due to a flaw in how file paths are handled, the attacker can trick the application into reading and returning arbitrary files from the server's file system. This could expose sensitive information.

Attacker needs network access.
Trigger by requesting database downloads.
Risk: reading sensitive server files.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could exploit a missing filepath validation in the database download feature to read arbitrary files from the server's filesystem. This could lead to the disclosure of sensitive server files, such as authentication credentials, when the application is accessible externally.

Arbitrary server files, including credentials.
Crafted requests to the download feature.
Unauthorized application access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Bold Reports Standalone Report Designer contains a critical arbitrary file read vulnerability. This advisory impacts teams responsible for the application's hosting and security, including infrastructure, platform, and security operations. The immediate first step is to identify all deployments of the affected software, confirm external reachability and business criticality, and then engage the appropriate system owners to prioritize remediation based on risk.

Application owners and infrastructure teams must own the issue.
Verify external reachability and asset criticality first.
Plan remediation based on confirmed exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Bold Reports Standalone Report Designer?

Bold Reports Standalone Report Designer is a web-based application used for creating, managing, and distributing business intelligence reports. Organizations typically deploy this tool to allow users to design and view complex data visualizations remotely. Because it handles various reporting assets, it includes features for managing data connections and database configurations, which require direct interaction with the underlying server's file system.

What does path traversal mean for CVE-2026-65689?

This CVE involves a weakness known as Improper Limitation of a Pathname to a Restricted Directory (CWE-22). In plain terms, the software fails to properly check the file paths requested by a user. An attacker can manipulate a specific request to 'traverse' outside of the intended folder, tricking the server into delivering files it should have kept private, such as configuration files or authentication credentials.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted request to the database download feature within the application. Because the software does not properly validate the requested file path, it processes the request as if it were a legitimate download. It is important to note that this requires no prior authentication; simply accessing the vulnerable download feature with the manipulated request path is sufficient to initiate the unauthorized file read.

Is my Bold Reports instance at risk?

According to Halo Surface Signal, this software is often deployed as an internet-facing service to facilitate remote reporting and design tasks. If your instance is reachable from the public internet, it is at higher risk because the vulnerability does not require a local network connection. You should assess whether your specific deployment is exposed to the internet or restricted to an internal network to understand your current risk profile.

How do I respond to CVE-2026-65689?

Your first step is to locate all instances of Bold Reports Standalone Report Designer in your environment. Once identified, confirm if these instances are accessible externally or handle sensitive data. Prioritize these assets for updates by engaging the relevant system owners to apply the vendor's provided fixes. Focus on moving to version 14.1.12 or later, which addresses the underlying path validation flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.