rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames contain…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Aug 24, 2026 · NIST NVD

   Detected

   rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the

2. Oct 14, 2026 · NIST NVD

   Updated

   rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the

Sources

• CVE.orgVulnerability recordCVE-2026-77914

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-77914

  30-day exploitation probability 0.7%

  first.org
• NIST NVDVulnerability recordCVE-2026-77914

  rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename paramete

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com