CVE-2026-64826

Received Received - Intake

Path Traversal in rConfig Prior to 8.2.13

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-64826

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

rConfig before version 8.2.13 has a path traversal vulnerability. Authenticated attackers can read arbitrary files by using unsanitized directory traversal sequences in the filename parameter of the download_export() method. By adding ../ sequences, attackers can escape the exports base directory and access sensitive files readable by the web server process.

Detection Guidance

Check for unusual GET requests containing ../ sequences in the filename parameter targeting rConfig's download_export() method. Inspect web server logs for patterns like 'filename=../../../../etc/passwd' or similar traversal attempts.

Impact Analysis

This vulnerability allows attackers to access sensitive files such as application environment files containing encryption keys, database credentials, and mail configuration. This could lead to data breaches, unauthorized access to systems, or further exploitation of the affected application.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade rConfig to version 8.2.13 or later immediately. If upgrading is not possible, restrict access to the download_export() endpoint via firewall rules or disable the feature entirely until patched.

Hi! I’m here to help you understand CVE-2026-64826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70