# CVE-2026-65690: Bold Reports Standalone Report Designer path traversal in file upload

Source: https://junglewise.ai/threats/cve-2026-65690-bold-reports-standalone-report-designer-path-traversal-in-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65690 · Severity: high · CVSS 8.8 · Published 2026-07-23

Bold Reports Standalone Report Designer, a tool used for creating and managing business reports, contains a security flaw in its file upload feature. An authorized user can bypass security restrictions to upload files to unauthorized locations on the server. This could allow an attacker to take full control of the system, potentially leading to data theft or service disruption.

Technologies: [Syncfusion Standalone Report Designer](https://junglewise.ai/threats/technologies/standalone-report-designer). Vendors: [Syncfusion](https://junglewise.ai/threats/vendors/syncfusion).

## Quick answers

**Is CVE-2026-65690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65690 being exploited in the wild.

**How severe is CVE-2026-65690?** High severity, with a CVSS score of 8.8, published 23 July 2026.

**Which products and versions are affected?** Syncfusion Standalone Report Designer < 14.1.12.

**Is there a fix for CVE-2026-65690?** A patch was published on 2026-07-20: Vendor released version 14.1.12 fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65690 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65690?** Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the file upload functionality of Bold Reports Standalone Report Designer prior to version 14.1.12. The application fails to properly validate user-supplied filenames, allowing an authenticated attacker to use traversal sequences (e.g., ../) to write files outside of the designated upload directory. By uploading malicious files to sensitive locations, an attacker can achieve remote code execution (RCE) with high privileges. This vulnerability is reachable over the network but requires at least low-level authenticated access. Users should update to version 14.1.12 or later to remediate the issue.

## Affected products

- Bold Reports (By Syncfusion) Standalone Report Designer < 14.1.12

## Timeline

- 2026-07-20: patched: Vendor released version 14.1.12 fixing the issue.
- 2026-07-23: advisory: CVE-2026-65690 published.

## References

- [https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1](https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1)
- [https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload](https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload)

## Related threats

- [Bold Reports Standalone Report Designer path traversal in database download](https://junglewise.ai/threats/cve-2026-65689-bold-reports-standalone-report-designer-path-traversal-in)
- [Bold Reports Standalone Report Designer path traversal in font processing](https://junglewise.ai/threats/cve-2026-65688-bold-reports-standalone-report-designer-path-traversal-in-font)
- [Bold Reports Standalone Report Designer path traversal in SVG processing](https://junglewise.ai/threats/cve-2026-65687-bold-reports-standalone-report-designer-path-traversal-in-svg)