CVE-2026-77914: 
rConfig vulnerability analysis and mitigation

CVE-2026-77914 is an authenticated path traversal vulnerability in rConfig V8 Core that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. It affects rConfig versions before 8.2.13 and was disclosed on August 24, 2026, with the patch released on August 10, 2026. The vulnerability was reported by Adam Nurudini (@QwesiRED) and assigned by VulnCheck. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, rConfig Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient validation of the filename parameter in the export download endpoint of rConfig V8 Core. An authenticated attacker can inject directory traversal sequences (e.g., ../) into the filename parameter to escape the intended export directory and cause the application to return files from arbitrary locations on the filesystem that are readable by the application process. No arbitrary file write or remote code execution capability has been identified as part of this vulnerability (rConfig Advisory, GitHub Advisory).

Successful exploitation allows any authenticated rConfig user to read sensitive files accessible to the application process, with a high confidentiality impact and no integrity or availability impact. Depending on the deployment, exposed files may include application configuration files, locally stored network device configuration data, credentials, or other sensitive information. While lateral movement via this vulnerability alone is limited, disclosure of credentials or configuration data could enable further attacks against the rConfig host or managed network devices (rConfig Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.0, indicating a very low probability of exploitation in the near term. Exploitation requires valid authentication to rConfig, which reduces the attack surface compared to unauthenticated vulnerabilities. NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact.

1. Authentication: Obtain valid rConfig credentials (e.g., any standard user account, as no elevated privileges are required beyond basic authentication).
2. Identify the export download endpoint: Locate the export download functionality within the rConfig V8 Core web interface or API, which accepts a filename parameter.
3. Craft a traversal payload: Construct a filename parameter containing directory traversal sequences such as ../../../../../../etc/passwd or ../../.env to target files outside the export directory.
4. Send the malicious request: Submit an authenticated HTTP request to the export download endpoint with the crafted filename parameter (e.g., GET /api/export/download?filename=../../.env).
5. Retrieve sensitive files: The application returns the contents of the targeted file, potentially exposing credentials, application configuration, or stored network device configurations readable by the application process (rConfig Advisory, GitHub Advisory).

• Network: Authenticated HTTP requests to the rConfig export download endpoint containing URL-encoded traversal sequences (e.g., %2F..%2F, ../, ..%5C) in the filename parameter; unusual file download responses containing non-export content (e.g., /etc/passwd, .env files).
• Logs: Web server or application access logs showing requests to the export download endpoint with filename values containing .. sequences; repeated requests to the same endpoint with varying traversal depths from a single authenticated session.
• File System: No direct file system artifacts are expected from read-only exploitation, but audit logs may show access to sensitive files (e.g., /etc/passwd, application .env, configuration files) by the web application process user.

Users should upgrade rConfig to version 8.2.13 or later, which validates requested filenames and enforces that resolved file paths remain within the designated export directory (rConfig Release). As interim mitigations, implement server-side input validation to reject filename parameters containing directory traversal sequences (../, ..\), and apply the principle of least privilege to restrict the files readable by the application process. Consider limiting access to the export download functionality to trusted administrator accounts only if business requirements permit.