CVE-2026-65689: Bold Reports Standalone Report Designer Path Traversal Vulnerability

CVE-2026-65689 details a critical path traversal vulnerability affecting Bold Reports Standalone Report Designer versions prior to 14.1.12. This flaw resides within the application's database download feature, which fails to properly validate filepaths provided in requests. Unauthenticated attackers can leverage this weakness by supplying a specially crafted HTTP request containing path traversal sequences to read arbitrary files directly from the server's filesystem. Successful exploitation allows for the disclosure of sensitive server files, including critical configuration data and authentication credentials, potentially leading to complete unauthorized access to the application and underlying system resources. This vulnerability carries a CVSS v3.1 base score of 9.8, indicating a severe risk to affected organizations.

Attack Chain

1. An unauthenticated attacker identifies an internet-facing instance of Bold Reports Standalone Report Designer vulnerable to CVE-2026-65689.
2. The attacker constructs a malicious HTTP request targeting the application's database download feature.
3. This crafted request includes path traversal sequences, such as ../ or ..%2f, embedded within the filename or path parameter intended for the download.
4. The vulnerable application, due to missing filepath validation, processes the request and resolves the traversed path.
5. The server attempts to read the file specified by the attacker from an arbitrary location on its filesystem.
6. If the file exists and permissions allow, its content is returned to the attacker as part of the download response.
7. The attacker analyzes the disclosed file for sensitive information, such as authentication credentials, configuration files, or other proprietary data.
8. Using the exfiltrated credentials, the attacker can gain further unauthorized access to the Bold Reports application or other connected systems.

Impact

The successful exploitation of CVE-2026-65689 allows unauthenticated attackers to perform arbitrary file reads on the server hosting Bold Reports Standalone Report Designer. This can lead to the disclosure of highly sensitive information, including user credentials, configuration files, and proprietary application data. Such disclosures enable attackers to escalate privileges, gain full unauthorized access to the application, compromise underlying server infrastructure, and potentially exfiltrate critical business data. Given the unauthenticated nature and the ability to read credentials, the potential for a complete system compromise is high, affecting the confidentiality, integrity, and availability of the application and its data.

Recommendation

• Immediately apply the patch by upgrading Bold Reports Standalone Report Designer to version 14.1.12 or later to address CVE-2026-65689.
• Deploy the provided Sigma rule to your SIEM to detect attempts at path traversal exploitation against your web infrastructure.
• Ensure web server logs (category webserver) are configured to capture full URI stems and query parameters for detection of suspicious patterns.
• Implement Web Application Firewall (WAF) rules to detect and block requests containing common path traversal sequences (../, %2e%2e%2f, etc.) targeting web applications.