A critical path traversal vulnerability in Bold Reports Standalone Report Designer allows unauthenticated remote attackers to read sensitive server files, posing a severe risk of credential theft.

This vulnerability is a path traversal flaw (CWE-22) located in the font processing component of the application. It permits unauthenticated attackers to supply crafted requests that bypass directory restrictions, enabling the disclosure of arbitrary files on the host filesystem with the privileges of the application process.

The ability for an unauthenticated user to read arbitrary files from the host server is a critical security failure. Successful exploitation could lead to the exposure of sensitive configuration files, system credentials, or proprietary data, which may grant an attacker full administrative control over the application environment. Given the CVSS score of 9.8, this flaw represents a maximum severity risk to business continuity and data confidentiality.

Immediate Action: Update the Bold Reports Standalone Report Designer to version 14.1.12 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review web server and application access logs for unusual request patterns, specifically those containing directory traversal sequences like dot dot slash, targeting font-related endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts, providing a temporary layer of defense until the software can be patched.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the lack of authentication required for exploitation, organizations must prioritize patching this component. Applying the vendor-provided update is the only effective way to remediate the underlying logic error and secure the server environment against unauthorized file access.