Is CVE-2026-65689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65689 being exploited in the wild.

How severe is CVE-2026-65689?

Critical severity, with a CVSS score of 9.8, published 23 July 2026.

Which products and versions are affected?

Syncfusion Standalone Report Designer before 14.1.12.

Is there a fix for CVE-2026-65689?

A patch was published on 2026-07-20: Vendor released version 14.1.12 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65689 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65689?

Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65689: Bold Reports Standalone Report Designer path traversal in database download

CVE-2026-65689 · Severity: critical · CVSS 9.8 · Published 2026-07-23

Bold Reports Standalone Report Designer, a tool used for creating and managing business reports, contains a security flaw in its database download feature. An unauthenticated attacker can exploit this to download sensitive files directly from the server's filesystem. This could lead to the theft of login credentials or other confidential data, potentially allowing an attacker to take full control of the application.

Technologies: Syncfusion Standalone Report Designer. Vendors: Syncfusion.

Quick answers

Is CVE-2026-65689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65689 being exploited in the wild.
How severe is CVE-2026-65689?: Critical severity, with a CVSS score of 9.8, published 23 July 2026.
Which products and versions are affected?: Syncfusion Standalone Report Designer before 14.1.12.
Is there a fix for CVE-2026-65689?: A patch was published on 2026-07-20: Vendor released version 14.1.12 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65689 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65689?: Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Bold Reports Standalone Report Designer versions prior to 14.1.12. The flaw is located within the database download functionality, which fails to properly validate user-supplied file paths. An unauthenticated remote attacker can exploit this by sending a specially crafted request to access files outside of the intended directory. Successful exploitation allows for the retrieval of sensitive system files, including configuration data and authentication credentials, which can be leveraged for further compromise of the host or application. The issue is resolved in version 14.1.12.

Affected products

Bold Reports (By Syncfusion) Standalone Report Designer before 14.1.12

Timeline

2026-07-20: patched: Vendor released version 14.1.12 to address the issue.
2026-07-23: disclosed: Vulnerability details and CVE-2026-65689 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.