CVE-2026-65690

Katalog CVE

CVSS 8.8 · High EPSS 0,90%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada syncfusion standalone report designer. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.

Rincian

Terbit di NVD

23 Juli 2026

Terakhir diubah

28 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-uploa... advisory pihak ketiga
• https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12 release notes