Description

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T17:18:18.260Z",
  "pubdate": "2026-08-24T17:18:18.260Z",
  "executiveSummary": "rConfig before 8.2.13 suffers from an authenticated path traversal vulnerability within its export download endpoint.\nThis vulnerability enables authenticated users to read arbitrary files from the underlying filesystem by supplying crafted filenames that incorporate directory traversal sequences.\nThe flaw affects rConfig versions prior to 8.2.13, posing significant risk to confidentiality as attackers can harvest sensitive system and configuration files readable by the application process.\nSuccessful exploitation requires authentication to the application, allowing an attacker with valid credentials to manipulate the filename parameter and escape the intended export directory boundaries.\nThe primary impact is unauthorized file disclosure, which can lead to further compromise by exposing credentials, configuration settings, or internal application data.",
  "technicalDetails": "The vulnerability resides in the export download endpoint of rConfig, specifically within the handling of the filename parameter.\nThe root cause is the insufficient sanitization and validation of user-supplied input used in file retrieval operations, failing to properly neutralize directory traversal sequences such as dot-dot-slash (../) patterns.\nAffected versions include all rConfig deployments prior to 8.2.13.\nExploitation requires the attacker to possess authenticated access to the application, lowering the barrier for internal attackers or compromised accounts.\nThe attack flow begins when an authenticated user sends an HTTP request to the export download endpoint with a maliciously crafted filename parameter containing directory traversal sequences.\nThe vulnerable component processes the unsanitized input, allowing it to traverse upward from the intended export directory to the root or other system directories.\nThe payload behavior leverages filesystem permissions to read arbitrary files that the web application process has read access to.\nPost-exploitation impact involves the unauthorized exfiltration of sensitive data, including system configuration files, application secrets, and operational credentials, facilitating subsequent privilege escalation or lateral movement."
}