CVE-2026-64826: 
rConfig vulnerability analysis and mitigation

CVE-2026-64826 is a path traversal vulnerability in rConfig, a network configuration management tool, that allows authenticated attackers to read arbitrary files on the server. Affecting all rConfig versions before 8.2.13, the flaw resides in the download_export() method of FileDownloadController, which concatenates unsanitized user input directly onto the export directory path. The vulnerability was disclosed and patched on August 12, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High), assigned by VulnCheck (Github Advisory, VulnCheck).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), classified under CAPEC-126 (Path Traversal). In vulnerable versions, FileDownloadController::download_export() built its file path by directly concatenating the raw filename GET parameter onto export_path() with no sanitization: $path = export_path() . $_GET['filename']. An authenticated attacker could supply ../ sequences (or URL-encoded variants such as ..%2F, or doubled-dot forms like ....//) to escape the exports directory and read any file accessible to the web server process. The fix, merged in PR #349, switches to the injected Laravel Request object, reduces the filename to a bare basename(), and validates the resolved realpath() against the export directory before serving the file — closing both traversal and symlink escape routes (rconfig PR #349, rconfig Commit).

Successful exploitation allows any authenticated rConfig user to read arbitrary files accessible to the web server process, with no impact on integrity or availability. High-value targets include the application .env file (containing APP_KEY, DB_PASSWORD, and mail credentials), /etc/passwd, application logs, and other sensitive configuration files. Exposure of database credentials or encryption keys could enable further attacks such as database compromise, decryption of stored secrets, or lateral movement within the network infrastructure managed by rConfig (Github Advisory, VulnCheck).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure. CISA's SSVC assessment (added August 13, 2026) classifies exploitation as "none" and the vulnerability as non-automatable with partial technical impact, indicating it is not currently in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.37%, placing it in the 31st percentile for exploitation likelihood within 30 days. Exploitation requires valid credentials but no elevated privileges, making it accessible to any authenticated user (Github Advisory, VulnCheck).

1. Authenticate: Obtain valid credentials for the target rConfig instance (any user-level account is sufficient) and log in to establish an authenticated session.
2. Identify the vulnerable endpoint: Locate the /download-export endpoint used by the FileDownloadController::download_export() method.
3. Craft a traversal payload: Construct a GET request with a filename parameter containing ../ sequences to escape the exports directory, e.g.:

   GET /download-export?filename=../../../../.env&type=export

4. Bypass naive filters (if present): Use URL-encoded variants (..%2F..%2F..%2F..%2F.env) or doubled-dot forms (....//....//....//....//.env) to evade simple string-replacement sanitizers.
5. Retrieve sensitive files: The server returns the contents of the targeted file (e.g., .env containing APP_KEY and DB_PASSWORD, or /etc/passwd) directly in the HTTP response, readable by the attacker (rconfig PR #349, Github Advisory).

• Network: HTTP GET requests to /download-export with filename parameters containing ../, ..%2F, ....//, or absolute paths (e.g., /etc/passwd); responses with unusually large or unexpected content types for an export endpoint.
• Logs: rConfig activity log entries (via activityLogIt) showing FILE DOWNLOAD warnings for filenames containing traversal sequences; web server access logs with encoded %2F or %2E%2E patterns in the filename query parameter targeting /download-export.
• File System: No direct file system artifacts are created by read-only exploitation; however, monitor for unexpected access to .env, /etc/passwd, or log files by the web server process (e.g., www-data, apache, nginx).
• Process: Unusual outbound connections from the rConfig server following access to the endpoint, potentially indicating credential reuse or follow-on attacks after credential harvesting (rconfig PR #349).

Upgrade rConfig to version 8.2.13 or later, which contains the fix that constrains export downloads to the export directory using basename() and realpath() validation. No official workaround short of patching is provided; however, operators can restrict access to the /download-export endpoint via WAF rules blocking requests with ../, ..%2F, or ....// patterns in the filename parameter. Additionally, apply the principle of least privilege to the web server process to minimize the impact of any file read. The release notes explicitly state: "Upgrade is recommended for all 8.x installations" (rconfig Release, rconfig Commit).