Which versions of rConfig are affected by CVE-2026-64826?

rConfig versions prior to 8.2.13 contain a path traversal vulnerability with no public exploit identified at time of analysis that allows authenticated users to extract sensitive configuration files…. A patch is available.

How to fix or mitigate CVE-2026-64826?

Within 24 hours: Inventory all rConfig deployments and document current versions in use. Within 7 days: Upgrade all instances to rConfig 8.2.13 or later and verify patch application across the environment. Within 30 days: Conduct a post-incident review of access logs from the vulnerability window to identify any unauthorized file access attempts, and rotate all database credentials and encryption keys that may have been exposed to account for potential compromise.

rConfig CVE-2026-64826

Q: What is the CVSS score of CVE-2026-64826?

CVE-2026-64826 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-57612 HIGH

Path Traversal (CWE-22)

2026-08-12 VulnCheck

GHSA-qrrp-6pvj-xfvf

Path Traversal Rconfig

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible with low-privilege auth required; purely a read operation with no integrity or availability impact, high confidentiality impact from .env file exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 21:34 vuln.today

Analysis Generated

Aug 12, 2026 - 21:34 vuln.today

CVE Published

Aug 12, 2026 - 20:44 cve.org

HIGH 7.1

DescriptionCVE.org

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

AnalysisAI

Path traversal in rConfig's file download endpoint exposes arbitrary files readable by the web server process to authenticated users. Affected versions prior to 8.2.13 fail to sanitize the filename GET parameter in the download_export() method, allowing ../ sequences to escape the exports directory. An attacker with valid credentials can exfiltrate sensitive application files including .env files containing encryption keys, database credentials, and mail configuration. No public exploit code or KEV listing has been identified at time of analysis.

Technical ContextAI

rConfig is a network device configuration management platform. The vulnerability exists in the FileDownloadController's download_export() method, which accepts a user-supplied filename GET parameter without sanitization. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) applies: the application constructs a file path by concatenating an exports base directory with attacker-controlled input, enabling directory traversal via ../ sequences. The CPE cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* covers all rConfig versions prior to 8.2.13. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N confirms network-accessible exploitation requiring only low-privilege authentication, with high confidentiality impact and no integrity or availability impact.

RemediationAI

Upgrade to rConfig V8 Core 8.2.13 immediately, as the vendor release notes designate this a security release and recommend upgrade for all 8.x installations. The patch is available at https://github.com/rconfig/rconfig/releases/tag/core-8.2.13, with the underlying fix in commit d133a466a2df9d065177de9a8ed50f1bfe438aee (https://github.com/rconfig/rconfig/commit/d133a466a2df9d065177de9a8ed50f1bfe438aee) and PR #349 (https://github.com/rconfig/rconfig/pull/349). If immediate patching is not possible, restrict access to the rConfig web interface to trusted network segments or VPN-only access to reduce the attacker pool to users who already have network-level access. Additionally, review and rotate any credentials stored in the application's .env file - particularly database passwords, encryption keys, and mail credentials - in case the vulnerability was previously exploited. Note that restricting network access does not eliminate the risk from compromised low-privilege accounts.