Is CVE-2026-65687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65687 being exploited in the wild.

How severe is CVE-2026-65687?

Critical severity, with a CVSS score of 9.8, published 23 July 2026.

Which products and versions are affected?

Syncfusion Standalone Report Designer before 14.1.12.

Is there a fix for CVE-2026-65687?

A patch was published on 2026-07-20: Vendor released version 14.1.12 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65687 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65687?

Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65687: Bold Reports Standalone Report Designer path traversal in SVG processing

CVE-2026-65687 · Severity: critical · CVSS 9.8 · Published 2026-07-23

Bold Reports Standalone Report Designer, a tool used for creating and managing business reports, contains a security flaw in how it handles image files. An unauthenticated attacker can exploit this to read sensitive files directly from the server's storage, such as system configuration files or login credentials. This could lead to a complete takeover of the application and unauthorized access to corporate data.

Technologies: Syncfusion Standalone Report Designer. Vendors: Syncfusion.

Quick answers

Is CVE-2026-65687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65687 being exploited in the wild.
How severe is CVE-2026-65687?: Critical severity, with a CVSS score of 9.8, published 23 July 2026.
Which products and versions are affected?: Syncfusion Standalone Report Designer before 14.1.12.
Is there a fix for CVE-2026-65687?: A patch was published on 2026-07-20: Vendor released version 14.1.12 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65687 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65687?: Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Bold Reports Standalone Report Designer versions prior to 14.1.12. The flaw is located within the SVG processing component, which fails to properly validate file paths provided in crafted requests. A remote, unauthenticated attacker can exploit this weakness to access sensitive files on the host operating system, including application credentials and configuration data. This vulnerability can be leveraged to achieve full unauthorized access to the application environment. The issue is addressed in version 14.1.12.

Affected products

Bold Reports (By SyncFusion) Standalone Report Designer before 14.1.12

Timeline

2026-07-20: patched: Vendor released version 14.1.12 to address the issue.
2026-07-23: advisory: NVD and VulnCheck published advisory details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.