CVE-2026-65687: Bold Reports File Read Vulnerability
TL;DR - Critical unauthenticated arbitrary file read in Bold Reports Standalone Report Designer. - Affects versions before 14.1.12; upgrade immediately. - No confirmed public exploitation yet, but internet-facing instances should be treated as high risk.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-65687 |
| CVSS | 9.8 (NVD) |
| Attack vector | Network reachable; exact vector string was not available in retrieved NVD data |
| Privileges required | None / unauthenticated |
| Patch available | Yes, fixed in 14.1.12 |
CVE-2026-65687 is a critical path traversal and arbitrary file read vulnerability in Bold Reports Standalone Report Designer. According to the NVD description, the flaw exists in the product’s SVG processing feature and results from missing filepath validation. A remote attacker can send a crafted request and cause the application to read files from the underlying server filesystem.
For defenders, the practical risk is not limited to file disclosure in the abstract. The NVD description explicitly warns that sensitive files, including authentication credentials, may be exposed, which can enable full unauthorized access to the application. That makes this a pre-auth disclosure bug with likely follow-on compromise potential, especially on systems where configuration files, service credentials, or connection strings are stored locally.
What Is This Vulnerability?
At its core, this is a path traversal style arbitrary file read caused by insufficient validation of file paths during SVG handling. When an application accepts attacker-controlled path input and fails to constrain it to a safe directory, the attacker may be able to traverse outside the intended storage path and request arbitrary local files. In this case, the vulnerable code path is tied to SVG processing in Bold Reports Standalone Report Designer.
The NVD description identifies the root cause as “missing filepath validation” in the SVG processing feature. That is enough to establish the core security failure even though the vendor advisory text could not be directly retrieved during research. In practice, the likely issue is that a crafted request can influence how the application resolves a path referenced during SVG handling, allowing the request to escape the intended document or asset directory and read other files on disk.
This matters because arbitrary file read often becomes the first step in a larger intrusion chain. Sensitive targets commonly include application configuration files, database connection strings, API keys, machine-level secrets, and local authentication material. If the report designer is hosted on Windows, Linux, or in a containerized deployment, the exact high-value files differ, but the operational impact is the same: the attacker may be able to gather enough data to authenticate elsewhere in the application stack.
Technical Notes
Because the exact exploit request format is not available in the sources provided, defenders should not assume detection is impossible. Focus on the vulnerable behavior: externally supplied requests that cause the application to resolve filesystem paths during SVG-related processing. In monitoring and code review, watch for path canonicalization gaps and directory traversal sequences such as ../, URL-encoded traversal, absolute paths, or UNC-style references where applicable.
Examples of suspicious traversal patterns to hunt for:
../
..%2f
..%252f
..\
..%5c
/etc/passwd
web.config
appsettings.json
Who Is Affected?
The confirmed affected product is Bold Reports Standalone Report Designer. The confirmed affected range from the NVD record is all versions before 14.1.12. The fixed release identified by the NVD references and supporting advisory context is 14.1.12.
If you are running version 14.1.11 or earlier, you should treat the instance as vulnerable unless you have a compensating vendor-provided mitigation that explicitly addresses CVE-2026-65687. If you do not know your installed version, assume exposure until you verify it. That is especially important for internet-accessible report design or report management environments where unauthenticated HTTP access is possible.
Organizations should also consider indirect exposure. Even if the application is not intentionally public, it may still be reachable through VPN-less admin portals, reverse proxies, dev/test environments, or staging systems. Internal-only deployments are not safe by default if attacker-controlled users, compromised desktops, or adjacent network access can reach the service.
Technical Notes
If you manage deployment automation or software inventory, validate installed versions on each host. The exact installation path and packaging model may differ, so use your platform-standard inventory mechanisms first.
# Linux package inventory examples
rpm -qa | grep -i "bold\|report"
dpkg -l | grep -i "bold\|report"
# Generic filesystem search example
find / -iname "*bold*report*" 2>/dev/null
# Windows software inventory example
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -match "Bold Reports|Report Designer" } |
Select-Object DisplayName, DisplayVersion, Publisher
CVSS Score Breakdown
The NVD assigns this CVE a CVSS v3.x base score of 9.8, which places it in the critical range. The full vector string was not available in the retrieved NVD data, so defenders should avoid claiming a component-by-component official vector unless they have the authoritative record directly in front of them. Still, the score aligns with the described properties of the vulnerability.
A 9.8 score is consistent with a flaw that is remotely reachable, requires no authentication, and has high impact due to sensitive file disclosure. While confidentiality impact is the most obvious consequence, the NVD description goes further and states that the issue can expose authentication credentials that enable full unauthorized access to the application. That is why this should not be treated as a low-grade information leak.
In practical terms, the score signals three operational realities: the attack surface is likely exposed over the network, exploitation does not require prior access, and the resulting disclosure can materially assist compromise. Even without direct remote code execution, a pre-auth arbitrary file read often gives attackers exactly what they need to pivot.
Technical Notes
Because the official vector string was not present in the retrieved output, teams documenting risk internally should phrase this carefully:
Confirmed from retrieved NVD data:
- Base score: 9.8
- Critical severity
- Unauthenticated
- Remote/crafted request based
- Arbitrary file read with potential credential disclosure
Not confirmed from retrieved NVD data:
- Full CVSS vector string
Exploitation Status
At the time of this write-up, no public PoC was confirmed from the retrieved sources. Likewise, active exploitation in the wild is not confirmed based on the available data. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-07-23.
That said, absence of KEV listing or publicly indexed exploit code should not be interpreted as safety. Vulnerabilities with a straightforward root cause such as missing filepath validation can often be reproduced quickly by experienced attackers. Because the issue is unauthenticated and tied to HTTP-exposed functionality, defenders should assume weaponization is plausible even if public evidence is not yet available.
The correct operational stance is: no known public exploitation confirmed from current sources, but exploitation should be considered feasible and urgent to preempt. If you operate an exposed instance, do not wait for KEV inclusion or social proof before patching.
Technical Notes
Use threat intel language precisely in tickets and incident updates:
Public PoC: Not confirmed from retrieved sources
Active exploitation: Not confirmed from retrieved sources
CISA KEV: No
Defender assumption: High likelihood of rapid exploit development due to pre-auth file read behavior
How to Detect It
Detection should focus on suspicious requests to SVG-related functionality, especially requests that include path traversal markers, encoded directory traversal sequences, absolute file paths, or references to known sensitive files. Because the exact vulnerable endpoint was not disclosed in the source material, defenders should inspect access logs, reverse proxy logs, WAF telemetry, and application diagnostics for any request involving SVG upload, rendering, preview, or import workflows.
A strong detection strategy combines request inspection with impact-based telemetry. On the request side, look for ../, %2e%2e%2f, %252e%252e%252f, Windows backslash traversal, or file names such as web.config, appsettings.json, .env, hosts, or /etc/passwd. On the host side, watch for the application process reading files outside its expected content directories shortly after an HTTP request to SVG-related routes.
Technical Notes
Concrete hunt patterns you can use immediately:
Web log indicators:
- Requests containing "../" or "..%2f"
- Requests containing "..\" or "..%5c"
- Requests containing "/etc/passwd"
- Requests containing "web.config"
- Requests containing "appsettings.json"
- Requests mentioning ".svg" plus traversal markers
# Splunk example for HTTP logs
index=web OR index=proxy
("..%2f" OR "../" OR "..%5c" OR "..\\" OR "/etc/passwd" OR "web.config" OR "appsettings.json")
(".svg" OR "svg")
| stats count by src_ip, uri, http_method, user_agent
// Microsoft Sentinel / KQL style example
CommonSecurityLog
| where RequestURL has ".svg"
or RequestURL has "../"
or RequestURL has "..%2f"
or RequestURL has "web.config"
or RequestURL has "/etc/passwd"
| summarize count() by SourceIP, RequestURL, RequestMethod, DeviceAction
rule Suspicious_Path_Traversal_Strings
{
strings:
$a = "../"
$b = "..%2f"
$c = "..%5c"
$d = "/etc/passwd"
$e = "web.config"
$f = "appsettings.json"
condition:
any of them
}
If you find suspicious requests, review surrounding activity for follow-on authentication using newly exposed credentials. Also inspect whether the application account accessed unusual files on disk or whether configuration and secret files were subsequently modified or used to access downstream systems.
Mitigation and Patching
The primary mitigation is to upgrade Bold Reports Standalone Report Designer to version 14.1.12 or later. The affected range is explicitly stated as before 14.1.12, and the fixed boundary is 14.1.12. If you have not yet upgraded, prioritize external-facing instances first, then any internal systems reachable by broad user populations or third parties.
If immediate patching is not possible, apply temporary exposure reduction measures. Restrict access to the application behind a VPN, IP allowlist, or reverse proxy ACL. Disable or limit unauthenticated access where operationally possible. Add WAF rules to block path traversal sequences and suspicious requests referencing SVG plus filesystem paths. These controls are compensating only; they do not remove the vulnerable code path.
Because the vulnerability may expose credentials, post-patch response should include more than just upgrading. Review whether secrets stored locally may have been read. If there is any suspicion of exploitation, rotate application secrets, database credentials, service account passwords, API keys, and any tokens present on the host.
Technical Notes
Use your deployment method’s documented upgrade process. Where supported by your environment, the operational sequence typically looks like this:
# Generic Linux service maintenance workflow
sudo systemctl stop <bold-reports-service-name>
# install or deploy Bold Reports Standalone Report Designer 14.1.12 or later
sudo systemctl start <bold-reports-service-name>
# Generic Windows service maintenance workflow
Stop-Service -Name "<BoldReportsServiceName>"
# install/update to 14.1.12 or later using your approved package or installer
Start-Service -Name "<BoldReportsServiceName>"
If you do not have a scripted package path, document the exact installed version before and after the change and retain installer hashes in your change record. Since the vendor advisory text was not directly retrievable in research, rely on your authenticated vendor portal or official release source to obtain the correct 14.1.12 package.
Example reverse proxy mitigation for obvious traversal payloads:
if ($request_uri ~* "(\..\/|%2e%2e%2f|%252e%252e%252f|%2e%2e\\|%5c\..%5c|/etc/passwd|web\.config|appsettings\.json)") {
return 403;
}
This kind of rule can reduce exposure but should not be treated as sufficient remediation. Attackers may vary encoding or target alternate paths not covered by simple signatures.
References
The authoritative vulnerability description comes from the NVD entry for CVE-2026-65687, which states that Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature. The NVD also provides the critical severity rating of 9.8 and notes the unauthenticated arbitrary file read impact.
A vendor release-history reference indicates 14.1.12 as the relevant fixed version, although the page returned HTTP 403 during retrieval in the research process. A secondary advisory from VulnCheck also aligns with the issue description and the 14.1.12 remediation boundary. As of this publication date, CISA KEV does not list this CVE.
- NVD CVE record: CVE-2026-65687
- Bold Reports release history: https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12
- VulnCheck advisory: https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-svg-processing
- Bold Reports product page: https://www.boldreports.com/standalone-report-designer
- Bold Reports product lifecycle/support context: https://www.boldreports.com/resources/support/product-lifecycle
For more information on cybersecurity best practices, visit our Cybersecurity Framework Glossary or learn about VPNs.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.