A path traversal vulnerability in the Bold Reports Standalone Report Designer allows authenticated attackers to perform unauthorized file operations, potentially leading to remote code execution.

The software fails to properly sanitize pathnames, resulting in a CWE-22 Path Traversal vulnerability. An authenticated attacker can leverage this flaw to overwrite or create files in restricted directories, which may result in remote code execution.

With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality and integrity of the hosting environment. Successful exploitation grants the attacker the ability to execute arbitrary commands, which could lead to a total compromise of the server hosting the report designer.

Immediate Action: Update the Standalone Report Designer to version 14.1.12 or later to address the path validation issue.

Proactive Monitoring: Audit file system logs for suspicious file write attempts or attempts to traverse directories outside of the intended application path.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal sequences (e.g., "../") in HTTP requests.

Public Exploit Available: Yes, a technical advisory from VulnCheck exists.

Due to the potential for remote code execution, this vulnerability must be addressed with high urgency. Administrators should verify their current version and apply the patch to version 14.1.12 as soon as possible to mitigate the risk of unauthorized system access.