Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-77914rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

Medium 6.5

In plain English

A medium-severity path traversal in rconfig from rconfig. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.7%top 46.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.

Affected products (as reported)

Vendor	Product	Versions
rconfig	rconfig	8.0.0 – before 8.2.13

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-m5rw-jcrm-mmwc) vendor-advisory
rConfig core-8.2.13 Release Notes release-notes
https://www.vulncheck.com/advisories/rconfig-v8-core-path-traversal-via-export-download-endpoint third-party-advisory