CVE-2026-64826 - rConfig 8.2.13 Path Traversal File Read via FileDownloadController
Brief
CVE ID : CVE-2026-64826
Published : Aug. 12, 2026, 8:44 p. m.
- 20 minutes ago
Description : rConfig before 8.
- 13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ..
/ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.
Severity: 7.1
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...