CVE-2026-77914: 
rConfig vulnerability analysis and mitigation

CVE-2026-77914 is an authenticated path traversal vulnerability in rConfig Core V8 that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. It affects rConfig Core versions 8.0.0 through 8.2.12 (fixed in 8.2.13). The vulnerability was published on August 24, 2026, with the patch released on August 10, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, rConfig Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient validation of the filename parameter in the export download endpoint (rConfig Advisory). An authenticated attacker can supply a crafted filename containing directory traversal sequences (e.g., ../../) to escape the intended export directory and cause the application to return arbitrary files readable by the application process. Exploitation requires only low-level authenticated access with no user interaction, and the attack is conducted entirely over the network with low complexity (GitHub Advisory). The fix enforces that resolved file paths remain within the designated export directory (rConfig Release).

Successful exploitation allows an authenticated attacker to read arbitrary files accessible to the rConfig application process, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive files at risk include application configuration files, locally stored network device configuration data, credentials, and other sensitive information depending on the deployment environment (rConfig Advisory). No arbitrary file write or remote code execution capability has been identified as part of this vulnerability, limiting the direct impact to data disclosure (rConfig Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.536% (43rd percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by Adam Nurudini (@QwesiRED) (rConfig Advisory).

1. Authentication: Obtain valid rConfig credentials (any authenticated user role is sufficient; no administrator privileges are required).
2. Identify the export download endpoint: Locate the export download functionality within the rConfig V8 Core web interface or API, which accepts a filename parameter.
3. Craft a traversal payload: Construct a malicious filename value containing directory traversal sequences, such as ../../../../etc/passwd or ../../../../var/www/html/rconfig/.env, targeting files readable by the application process.
4. Submit the request: Send an authenticated HTTP request to the export download endpoint with the crafted filename parameter (e.g., via the web UI or a direct API call with a valid session token).
5. Retrieve sensitive files: The server returns the contents of the targeted file outside the intended export directory, potentially exposing credentials, configuration data, or other sensitive information (rConfig Advisory, GitHub Advisory).

• Network: Authenticated HTTP requests to the rConfig export download endpoint containing URL-encoded traversal sequences (e.g., %2e%2e%2f, ../, ..\) in the filename parameter; unusual file download responses containing system file content (e.g., /etc/passwd, .env files).
• Logs: Web server access logs showing requests to the export download endpoint with filename values containing ../ or encoded equivalents; application logs recording file access attempts outside the export directory.
• File System: No direct file system artifacts are expected from read-only exploitation, but audit logs may show unexpected file reads by the application process user on sensitive paths such as /etc/, application .env files, or configuration directories.

Users should upgrade to rConfig V8 Core version 8.2.13 or later, which validates requested filenames and enforces that resolved file paths remain within the designated export directory (rConfig Release). As interim mitigations, implement server-side input validation to reject filenames containing directory traversal sequences (../, ..\, or URL-encoded equivalents), and apply the principle of least privilege to restrict the files accessible by the rConfig application process. Restricting export functionality to trusted or administrator-level users only can further reduce the attack surface (GitHub Advisory).