CVE-2026-64826

Description

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

References

https://www.vulncheck.com/advisories/rconfig-path-traversal-file-read-via-filedownloadcontroller

https://github.com/rconfig/rconfig/releases/tag/core-8.2.13

https://github.com/rconfig/rconfig/pull/349

https://github.com/rconfig/rconfig/commit/d133a466a2df9d065177de9a8ed50f1bfe438aee

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4