syncfusion vulnerabilities

Products

• standalone report designer 4
• ej2 aspcore file provider 1
• ej2-javascript-ui-controls 1
• nodejs file system provider 1
• syncfusion 1

Latest syncfusion CVEs

Newest publication first

1. CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

   Published 2026-07-23

   High·CVSS 8.7 EPSS 0.90%

   Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this...

2. CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.87%

   Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can expl...

3. CVE-2026-65688 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.87%

   Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploi...

4. CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.87%

   Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit...

5. CVE-2026-16630 syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection

   Published 2026-07-22

   Medium·CVSS 4.8 EPSS 1.1%

   A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been di...

6. CVE-2025-63260 SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.

   Published 2026-03-20

   Medium·CVSS 5.4 EPSS 0.17%

   SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.

7. CVE-2023-26563 The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read a...

   Published 2023-07-12

   Critical·CVSS 9.8 EPSS 1.9%

   The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read any file, delete any file, upload any file to any directory accessible by the web...

8. CVE-2023-26564 The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, downlo...

   Published 2023-07-12

   Critical·CVSS 9.8 EPSS 1.7%

   The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.