Description

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T21:17:39.427Z",
  "pubdate": "2026-08-12T21:17:39.427Z",
  "executiveSummary": "A path traversal vulnerability exists in rConfig prior to version 8.2.13, affecting the download_export() method. The vulnerability arises due to insufficient sanitization of user-supplied input passed via the filename GET parameter. An authenticated attacker can exploit this flaw by supplying directory traversal sequences, specifically using ../ characters, to escape the intended exports base directory. Successful exploitation grants the adversary the capability to read arbitrary files accessible to the underlying web server process. The impact of this security flaw is critical, as it exposes highly sensitive system and application environment files containing application encryption keys, database credentials, and mail configuration settings. This compromises the confidentiality of the entire rConfig deployment and potentially allows further lateral movement or privilege escalation within the affected infrastructure. Exploitation requires authenticated access to the application, but no specific elevated privileges beyond standard authentication are mentioned in the prerequisites.",
  "technicalDetails": "The vulnerability resides within the download_export() method of the rConfig application, specifically affecting versions prior to 8.2.13. The root cause of the issue is the lack of proper input validation and sanitization on the filename GET parameter before it is used in file system operations. When handling requests to download export files, the application fails to adequately neutralize or restrict directory traversal sequences such as ../ provided by the user.\nTo execute the attack, an authenticated adversary crafts an HTTP GET request targeting the vulnerable download_export() functionality. By injecting multiple ../ sequences into the filename parameter, the attacker forces the file retrieval logic to traverse upward from the restricted exports base directory into the broader file system hierarchy of the hosting operating system. Because the web server process runs with specific read permissions, the application retrieves and returns the contents of targeted files outside the export scope.\nThe attack flow proceeds as follows: First, the authenticated user initiates a request to the download endpoint with a malicious payload in the filename parameter. Second, the vulnerable download_export() method processes the unsanitized string without verifying if the requested file path resolves within the designated base directory. Third, the operating system resolves the path traversal sequence, pointing to sensitive system or application files. Finally, the application reads the targeted file and streams its contents back to the attacker in the HTTP response.\nPost-exploitation impact includes the unauthorized disclosure of critical configuration assets. The exposed files typically encompass application environment configurations containing sensitive credentials, including database connection strings, application encryption keys, and mail server credentials. An attacker can leverage these harvested secrets to compromise database integrity, decrypt sensitive data, or impersonate services interacting with the rConfig installation."
}