{"id":"CVE-2026-64826","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-64826","summary":"rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the…","details":"rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.","published":"2026-08-12T21:17:39.427","modified":"2026-08-12T21:17:39.427","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/rconfig/rconfig/commit/d133a466a2df9d065177de9a8ed50f1bfe438aee","label":"rconfig/rconfig@d133a46"},"references":[{"type":"WEB","url":"https://github.com/rconfig/rconfig/commit/d133a466a2df9d065177de9a8ed50f1bfe438aee"},{"type":"WEB","url":"https://github.com/rconfig/rconfig/pull/349"},{"type":"WEB","url":"https://github.com/rconfig/rconfig/releases/tag/core-8.2.13"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/rconfig-path-traversal-file-read-via-filedownloadcontroller"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T21:17:39.427"}}