CVE-2026-73642: Path Traversal in Dayforce Payroll
Published Sep 28, 2026
·Updated
Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.
Affected Software
1 affected component
Dayforce Dayforce Payroll=R2026.2.0
Event History
Sep 28, 2026
CVE Published
via MITRE·01:12 PM
Data Sourced
via MITRE·01:12 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which releases should be treated as potentially affected?
The issue has been confirmed only in Dayforce Payroll R2026.2.0. Other versions may also be affected, but this has not been confirmed because vendor contact attempts were unsuccessful.
2
Does an attacker need an account or prior access to exploit this?
No. The reported attack can be performed by an unauthenticated attacker using a GET request with a file-path parameter.