Skip to main content

rConfig CVE-2026-77914

| EUVDEUVD-2026-64952 HIGH
Path Traversal (CWE-22)
2026-08-24 VulnCheck GHSA-6928-5hpx-7r3v
Path Traversal Rconfig
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible, low-complexity read-only path traversal requiring authenticated session (PR:L); scope unchanged, only confidentiality impacted.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 24, 2026 - 17:02 EUVD
Source Code Evidence Fetched
Aug 24, 2026 - 16:51 vuln.today
Analysis Generated
Aug 24, 2026 - 16:51 vuln.today
CVE Published
Aug 24, 2026 - 16:07 cve.org
HIGH 7.1

DescriptionCVE.org

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.

AnalysisAI

Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid rConfig credentials
Delivery
Authenticate to rConfig web interface
Exploit
Send crafted export download request with traversal filename
Execution
Application resolves path outside export directory
Persist
Read arbitrary file accessible to application process
Impact
Exfiltrate sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the rConfig instance, consistent with the CVSS 4.0 PR:L metric; unauthenticated network access alone is not sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.1 reflects a network-accessible attack (AV:N) with low complexity (AC:L), no special attack conditions (AT:N), low privilege requirements (PR:L), and high confidentiality impact (VC:H) with no integrity or availability impact - an accurate characterization of a read-only authenticated path traversal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated rConfig operator crafts an HTTP request to the export download endpoint with a filename parameter containing sequences such as '../../etc/passwd' or '../../../../var/www/rconfig/.env'. The application processes the unsanitized parameter, resolves the path outside the export directory, and returns the contents of the targeted file in the HTTP response. …
Remediation Upgrade to rConfig V8 Core 8.2.13 or later; the release is available at https://github.com/rconfig/rconfig/releases/tag/core-8.2.13 and the vendor security advisory is at https://github.com/rconfig/rconfig/security/advisories/GHSA-m5rw-jcrm-mmwc. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all rConfig instances running versions before 8.2.13 and catalog which systems contain sensitive data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rconfig

View all
CVE-2020-10221 HIGH POC
8.8 Mar 08

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands vi
CVE-2020-10220 CRITICAL POC
9.8 Mar 07

An issue was discovered in rConfig through 3.9.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2019-16662 CRITICAL POC
9.8 Oct 28

An issue was discovered in rConfig 3.9.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2022-44384 HIGH POC
8.8 Nov 17

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP fi
CVE-2020-13638 CRITICAL POC
9.8 Nov 13

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account cr
CVE-2020-10549 CRITICAL POC
9.8 Jun 04

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Rated critical severity (CVSS 9.
CVE-2020-10548 CRITICAL POC
9.8 Jun 04

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Rated critical severity (CVSS 9.8
CVE-2020-10547 CRITICAL POC
9.8 Jun 04

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Rated critical s
CVE-2020-10546 CRITICAL POC
9.8 Jun 04

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Rated critical severit
CVE-2020-10879 CRITICAL POC
9.8 Mar 23

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nod
CVE-2021-29004 HIGH POC
8.8 Oct 11

rConfig 3.9.6 is affected by SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2021-29005 HIGH POC
8.8 Oct 11

Insecure permission of chmod command on rConfig server 3.9.6 exists. Rated high severity (CVSS 8.8), this vulnerability

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-77914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy