CVE-2026-77914

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13

Description Authenticated users can read arbitrary files by providing crafted filenames containing directory traversal sequences to the export download endpoint. By manipulating the filename parameter, an attacker can escape the intended export directory and access files outside of it that are readable by the application process. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 8.2.13 or later. Avoid using the filename parameter in the export download endpoint until the update is applied.