CVE-2026-77914CWE-22path-traversal

CVE-2026-77914

Medium · published August 24, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00717 · 53.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-24T21:18Z
References (3)
https://github.com/rconfig/rconfig/releases/tag/core-8.2.13 · [email protected]https://github.com/rconfig/rconfig/security/advisories/GHSA-m5rw-jcrm-mmwc · [email protected]https://www.vulncheck.com/advisories/rconfig-v8-core-path-traversal-via-export-download-endpoint · [email protected]
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 1%
    epss
  • 24 AUG 16:07Z
    rConfig < 8.2.13 Core Path Traversal via Export Download Endpoint
    cvelistv5