CVE-2026-64826
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
rConfig before 8.2.13 has a path traversal vulnerability in the download_export() method, allowing authenticated attackers to read arbitrary files by supplying ../ sequences in the filename parameter. Sensitive files like environment files with encryption keys, database credentials, and mail config can be accessed.
Risk Assessment
Risk of sensitive data exposure, including credentials and keys, potentially leading to further attacks on the infrastructure.
Recommendation
Update rConfig to version 8.2.13 or later, which includes the fix.
Original NVD description (English source)
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.