Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-64826rConfig < 8.2.13 Path Traversal File Read via FileDownloadController

Medium 6.5

In plain English

A medium-severity path traversal in rConfig from rConfig. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

Affected products (as reported)

Vendor	Product	Versions
rConfig	rConfig	0 – before 8.2.13

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/rconfig-path-traversal-file-read-via-filedownloadcontroller third-party-advisory