Answer in brief
CVE-2026-65689 records a Unknown severity vulnerability in Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download. The current sources do not mark it as known exploited. The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Bold Reports (By SyncFusion)/Standalone Report Designergeneric | 6.3 || 7.1.10 || 9.1 || 10.1 || 11.1 || 12.1 || 13.1 | Not reported |
Published upstream
Jul 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-65689 records a Unknown severity vulnerability in Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download. The current sources do not mark it as known exploited. The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Bold Reports (By SyncFusion)/Standalone Report Designergeneric | 6.3 || 7.1.10 || 9.1 || 10.1 || 11.1 || 12.1 || 13.1 | Not reported |
Published upstream
Jul 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Quoted source text, attributed separately from HOL analysis.