rConfig CVE-2026-64826

Exploitation requires a valid rConfig account at any privilege level (PR:L in CVSS 4.0 confirms low-privilege authentication is sufficient - unauthenticated access is not possible). The vulnerable endpoint is the download_export() method in the FileDownloadController, accessible via HTTP GET request with a filename parameter. The attacker must be able to reach the rConfig web interface over the network (AV:N). No special application features need to be enabled beyond the default export functionality. Exploitation is limited by the requirement for valid credentials and by the web server process's file read permissions - files unreadable by the web server process (e.g., /etc/shadow on hardened systems) cannot be exfiltrated. The attack does not require user interaction (UI:N) once credentials are obtained.

The CVSS 4.0 score of 7.1 reflects a genuine confidentiality risk that warrants prompt remediation for any organization running rConfig. The attack vector is network-accessible (AV:N), complexity is low (AC:L), and only low-privilege credentials are required (PR:L) - meaning any authenticated user, including read-only operators, can exploit this. The high confidentiality impact (VC:H) is justified by the potential to read .env files containing database credentials and encryption keys, which could enable full application compromise as a secondary step. No EPSS data was provided, and this vulnerability is not in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; however, the simplicity of the attack (crafting a GET request with ../ sequences) makes it trivially automatable once credentials are obtained. The absence of integrity and availability impact (VI:N, VA:N) limits the direct blast radius, but credential exfiltration from .env files represents a meaningful pivot point. The patch (8.2.13) addresses not only this path traversal but five other security issues in the same release, suggesting the application had multiple concurrent access control weaknesses that compound risk.

An attacker with any valid rConfig account - including a read-only operator account - sends a crafted GET request to the download_export() endpoint with a filename parameter containing repeated ../ sequences such as ../../../../.env. The web server process reads and returns the application environment file, exposing database credentials and encryption keys. No public proof-of-concept code has been identified, but the attack requires only standard HTTP tooling and knowledge of common Linux file paths.