CVE-2026-77914: rConfig < 8.2.13 Core Path Traversal via Export Download Endpoint
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfigto a version that resolves this vulnerability.Fixed in 8.2.13 - Compensating control
Until all affected instances are upgraded to rConfig 8.2.13, restrict access to the export download endpoint so only trusted authenticated users can reach it.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to rConfig and able to send requests to the export download endpoint. The attacker also needs to know or guess paths to files that are readable by the rConfig application process.
Are default deployments affected?
The provided information identifies rConfig versions before 8.2.13 as affected, but does not state whether the vulnerable export download endpoint is enabled or reachable in a default deployment.
What is the impact if exploitation succeeds?
The attacker can read arbitrary files outside the intended export directory, subject to the permissions of the rConfig application process. The supplied data describes confidentiality impact only; it does not indicate file modification or service disruption.
What can be done if upgrading is not immediately possible?
The provided information does not specify a workaround. Restrict access to rConfig and its export download endpoint to trusted authenticated users until the deployment can be updated to 8.2.13 or later.