CVE-2026-77914
Last modified
CVE-2026-77914 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| rconfig | rconfig | >= 8.0.0, < 8.2.13 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-77914?
How severe is CVE-2026-77914?
How do I fix CVE-2026-77914?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-77908Improper control of generation of code ('code injection') in…8.8
- CVE-2026-77909Insufficiently protected credentials in Azure CycleCloud all…6.5
- CVE-2026-7791Improper privilege management in the log rotation mechanism …7.8
- CVE-2026-77910Incorrect authorization in Microsoft Exchange Server allows …8.8
- CVE-2026-77911Out-of-bounds read in Microsoft Office Word allows an unauth…6.5
- CVE-2026-77912A stored cross-site scripting (XSS) vulnerability was identi…5.4
- CVE-2026-77915rConfig Core 8.0.0 before 8.2.10 contains an authentication …9.8
- CVE-2026-7792The WPForms – Easy Form Builder for WordPress – Contact Form…5.3
- CVE-2026-77923Dolibarr 21.0.0 before 24.0.0 contains an authorization bypa…4.3
- CVE-2026-77926Aix-DB 1.2.4 contains a remote code execution vulnerability …8.8
- CVE-2026-77927ClipBucket v5 before 5.5.3-#182 contains a blind SQL injecti…6.5
- CVE-2026-77928ClipBucket v5 before 5.5.3-#182 contains a blind SQL injecti…6.5
Are you affected by CVE-2026-77914?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST