CVE-2026-77914: rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-64826.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfig Coreto a version that resolves this vulnerability.Fixed in 8.2.13
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to rConfig and able to send requests to the export download endpoint. The attacker also needs to know or guess paths to files that are readable by the rConfig application process.
Are default deployments affected?
The provided information identifies rConfig versions before 8.2.13 as affected, but does not state whether the vulnerable export download endpoint is enabled or reachable in a default deployment.
What is the impact if exploitation succeeds?
The attacker can read arbitrary files outside the intended export directory, subject to the permissions of the rConfig application process. The supplied data describes confidentiality impact only; it does not indicate file modification or service disruption.
What can be done if upgrading is not immediately possible?
The provided information does not specify a workaround. Restrict access to rConfig and its export download endpoint to trusted authenticated users until the deployment can be updated to 8.2.13 or later.