CVE-2026-64826: rConfig < 8.2.13 Path Traversal File Read via FileDownloadController
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfigto a version that resolves this vulnerability.Fixed in 8.2.13 - Compensating control
Ensure only authenticated attackers can access the affected download_export() functionality in FileDownloadController (e.g., enforce strong authentication/authorization for the export endpoint) to reduce exploitability of the path traversal in the filename GET parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64826?
CVE-2026-64826 has a medium severity score of 6.5.
How do I fix CVE-2026-64826?
To fix CVE-2026-64826, upgrade to rConfig version 8.2.13 or later.
What exploit does CVE-2026-64826 present?
CVE-2026-64826 allows authenticated attackers to conduct path traversal attacks to read arbitrary files.
What systems are affected by CVE-2026-64826?
CVE-2026-64826 affects versions of rConfig prior to 8.2.13.
What is the impact of CVE-2026-64826?
The impact of CVE-2026-64826 is that it enables attackers to access sensitive files on the server.