CVE-2026-73642

Name of the Vulnerable Software and Affected Versions Dayforce Payroll version R2026.2.0

Description An unauthenticated attacker can perform a Path Traversal attack via the file download functionality. By sending a GET request with the file path parameter set to an absolute local file path, an attacker can access files outside the intended directory. Path Traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.