CVE-2026-65690 is a path traversal vulnerability in Bold Reports Standalone Report Designer's DataHub module, present in versions >=6.3 and <14.1.12. The vulnerability arises due to missing filepath validation in the file upload feature, enabling authenticated attackers to traverse outside restricted directories by providing crafted filenames. Successful exploitation can result in arbitrary command execution with elevated privileges on the affected server. The DataHub module was introduced in version 6.3, so earlier versions are not vulnerable.

An authenticated attacker can exploit this vulnerability to traverse directories outside the intended restricted directory, potentially leading to arbitrary command execution with high privileges on the server. This can compromise the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable versions to untrusted networks.