rConfig CVE-2026-77914

Exploitation requires a valid authenticated session on the rConfig instance, consistent with the CVSS 4.0 PR:L metric; unauthenticated network access alone is not sufficient. The attacker must be able to reach the export download endpoint over the network (AV:N). No special or non-default configuration is required - the vulnerability exists in a standard, routed application feature. The files accessible via traversal are constrained to those readable by the OS user account under which the rConfig process runs, which is a meaningful limiting factor if the process is run with least-privilege. Limiting factors: valid rConfig credentials must be obtained or already held; OS file permissions cap the traversal's reach; no indication of guest or anonymous access vectors. The attack does not require user interaction (UI:N) beyond the authenticated attacker initiating the request.

The CVSS 4.0 score of 7.1 reflects a network-accessible attack (AV:N) with low complexity (AC:L), no special attack conditions (AT:N), low privilege requirements (PR:L), and high confidentiality impact (VC:H) with no integrity or availability impact - an accurate characterization of a read-only authenticated path traversal. The authentication prerequisite (PR:L) is the primary real-world mitigating factor: mass opportunistic exploitation is constrained to actors who already hold valid rConfig credentials, excluding unauthenticated internet-facing attackers. The attack class itself is highly automatable once credentials are in hand, as directory traversal via filename parameter manipulation requires no advanced tooling or complex chaining. No EPSS score was provided in the source intelligence, and no CISA KEV listing exists, keeping urgency below that of actively exploited vulnerabilities. The absence of a confirmed public proof-of-concept further reduces near-term exploitation pressure. However, the breadth of related fixes in 8.2.13 - covering templates, reports, repository browsing, credential exposure, and user management - suggests that any attacker with legitimate rConfig access faces a target-rich application; organizations running rConfig where operator accounts are shared or loosely controlled should treat this as a priority patch rather than a deferred maintenance item.

An authenticated rConfig operator crafts an HTTP request to the export download endpoint with a filename parameter containing sequences such as '../../etc/passwd' or '../../../../var/www/rconfig/.env'. The application processes the unsanitized parameter, resolves the path outside the export directory, and returns the contents of the targeted file in the HTTP response. Sensitive files readable by the application process - such as configuration files containing database credentials or API keys - can be exfiltrated without triggering obvious application-level alerts.