CVE-2026-65689 is a critical path traversal vulnerability in Bold Reports Standalone Report Designer before version 14.1.12. The vulnerability arises from missing filepath validation in the database download functionality, enabling unauthenticated attackers to craft requests that read arbitrary files from the server filesystem. Successful exploitation can disclose sensitive server files such as authentication credentials, which may allow attackers to gain full unauthorized access to the application. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability to read arbitrary files on the server hosting the Bold Reports Standalone Report Designer application without authentication. This can lead to disclosure of sensitive information including authentication credentials, which may result in full unauthorized access to the application and compromise of its data and functionality. The vulnerability affects confidentiality, integrity, and availability with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious requests targeting the database download feature. Avoid exposing the application to untrusted networks where possible.