{"id":"CVE-2026-64826","summary":"rConfig \u003c 8.2.13 Path Traversal File Read via FileDownloadController","details":"rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.","modified":"2026-08-15T11:46:57.940454751Z","published":"2026-08-12T20:44:33.770Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64826.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64826.json"},{"type":"ADVISORY","url":"https://github.com/rconfig/rconfig/releases/tag/core-8.2.13"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64826"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rconfig-path-traversal-file-read-via-filedownloadcontroller"},{"type":"REPORT","url":"https://github.com/rconfig/rconfig/pull/349"},{"type":"FIX","url":"https://github.com/rconfig/rconfig/commit/d133a466a2df9d065177de9a8ed50f1bfe438aee"},{"type":"PACKAGE","url":"https://github.com/rconfig/rconfig"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rconfig/rconfig","events":[{"introduced":"0"},{"fixed":"72b60a41d9589f3b2e0c5ea0062734b6a0b5a86d"},{"fixed":"d133a466a2df9d065177de9a8ed50f1bfe438aee"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"8.2.13"}]}}],"versions":["core-8.2.12","core-8.2.11","core-8.2.10","core-8.2.9","core-8.2.8","core-8.2.7","core-8.2.6","core-8.2.5","core-8.2.4","core-8.2.3","core-8.2.0","core-8.1.3","core-8.1.2","core-8.1.1","core-8.1.0","core-8.0.2","core-8.0.1","core-8.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64826.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}