CVE-2026-64826

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13

Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export() method. By using ../ sequences, an attacker can escape the exports base directory to access sensitive files readable by the web server process, such as application environment files containing database credentials, encryption keys, and mail configuration.

Recommendations Update rConfig to version 8.2.13 or later. As a temporary mitigation, restrict access to the download export() method or avoid using the filename parameter until the update is applied.