Critical Bold Reports Flaw Risks Server Data

Bold Reports Standalone Report Designer versions prior to 14.1.12 contain a critical path traversal vulnerability identified as CVE-2026-65689. This flaw allows unauthenticated attackers to bypass security controls and read arbitrary files from the server filesystem, presenting a severe risk to data confidentiality and system integrity.

What's at Risk

The vulnerability affects all instances of Bold Reports Standalone Report Designer running versions earlier than 14.1.12. Organizations utilizing this software for report generation are at risk, particularly those with internet-facing deployments where the application is accessible to remote, unauthenticated users.

Because the flaw resides in the database download feature, any server hosting this software is potentially exposed. An attacker successfully exploiting this vulnerability can retrieve sensitive configuration files, authentication credentials, and other system data, which could lead to full unauthorized access to the application and the underlying server environment.

How the Flaw Works

This vulnerability is classified as a path traversal or directory traversal flaw. This type of security weakness occurs when an application fails to properly sanitize user-supplied input before using it to construct a file path. By including special characters, such as dot-dot-slash sequences, an attacker can manipulate the file path to access directories and files outside of the intended, restricted application folder.

In a general sense, path traversal flaws allow attackers to escape the application's sandbox. Once access to the filesystem is achieved, the attacker can traverse through system directories to locate sensitive files. If the application process runs with elevated privileges, the attacker may gain access to files that would normally be protected from standard users, potentially exposing system-wide secrets or sensitive business data.

How to Protect Your Systems

• Upgrade immediately to Bold Reports Standalone Report Designer version 14.1.12 or later to apply the official vendor patch.
• Restrict network access to the report designer interface by utilizing firewalls or VPNs to ensure the application is not exposed to the public internet.
• Monitor server logs for suspicious request patterns, specifically looking for attempts to access unexpected file paths or repeated directory traversal sequences.
• Apply the principle of least privilege by ensuring the service account running the report designer application has the minimum filesystem permissions necessary for its function.
• Implement file integrity monitoring to detect unauthorized access or modifications to critical system configuration files.

With a CVSS 3.1 score of 9.8, this vulnerability is categorized as CRITICAL. Given the ease of exploitation by unauthenticated actors and the potential for full system compromise, administrators should prioritize updating their software installations as the primary defense against potential exploitation of this weakness.