Path Traversal Vulnerability in rConfig by rConfig Technologies

CVE-2026-64826

What is CVE-2026-64826?

rConfig prior to version 8.2.13 contains a path traversal vulnerability that enables authenticated attackers to read arbitrary files. By manipulating the filename GET parameter in the download_export() method with unsanitized directory traversal sequences (such as ../), attackers can escape the designated exports base directory and gain access to sensitive files accessible by the web server process. This includes critical application environment files that may contain sensitive information such as encryption keys, database credentials, and mail configuration, posing a risk to system integrity and security.

References