Answer in brief
CVE-2026-65690 records a Unknown severity vulnerability in Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload. The current sources do not mark it as known exploited. The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Bold Reports (By SyncFusion)/Standalone Report Designergeneric | 6.3 || 7.1.10 || 9.1 || 10.1 || 11.1 || 12.1 || 13.1 | Not reported |
Published upstream
Jul 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-65690 records a Unknown severity vulnerability in Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload. The current sources do not mark it as known exploited. The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Bold Reports (By SyncFusion)/Standalone Report Designer (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Bold Reports (By SyncFusion)/Standalone Report Designergeneric | 6.3 || 7.1.10 || 9.1 || 10.1 || 11.1 || 12.1 || 13.1 | Not reported |
Published upstream
Jul 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Quoted source text, attributed separately from HOL analysis.