CVE-2026-64826: rConfig Path Traversal Vulnerability

CVE-2026-64826 Overview

CVE-2026-64826 is a path traversal vulnerability [CWE-22] in rConfig versions before 8.2.13. The flaw resides in the download_export() method of FileDownloadController, which fails to sanitize the filename GET parameter. Authenticated attackers can supply directory traversal sequences such as ../ to escape the exports base directory and read arbitrary files accessible to the web server process. Exposed data can include application environment files containing encryption keys, database credentials, and mail configuration. The vulnerability was patched in rConfig 8.2.13.

Critical Impact
Authenticated attackers can read sensitive files including .env files containing database credentials, encryption keys, and mail configuration, enabling further compromise of the rConfig deployment and connected network devices.

Affected Products

rConfig versions prior to 8.2.13
FileDownloadController component (app/Http/Controllers/FileDownloadController.php)
Deployments exposing the download_export() endpoint to authenticated users

Discovery Timeline

2026-08-12 - CVE-2026-64826 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64826

Vulnerability Analysis

The vulnerability exists in rConfig's FileDownloadController, a Laravel controller responsible for serving exported configuration files. The download_export() method accepts a filename value from the HTTP GET request and passes it to file read operations without validating that the resolved path remains inside the intended exports directory.

Because the parameter is concatenated into a filesystem path, an authenticated user can inject ../ sequences to traverse outside the exports base directory. The web server process then reads any file its Unix user can access, including Laravel's .env file. That file typically contains APP_KEY, database credentials, and SMTP secrets.

Compromise of APP_KEY allows an attacker to forge signed cookies and tamper with encrypted session data. Exposed database credentials enable direct access to stored device inventories and network configuration backups managed by rConfig.

Root Cause

The root cause is missing input sanitization on the filename GET parameter. The controller trusts user-supplied path components and does not canonicalize the resulting path or restrict reads to the exports directory. This is a classic Path Traversal weakness [CWE-22].

Attack Vector

Exploitation requires network access to the rConfig web interface and a valid authenticated session. The attacker sends a crafted GET request to the export download endpoint with a filename value containing directory traversal sequences pointing at a target file such as ../../../../.env. The server responds with the raw file contents.

php

// Patch context - app/Http/Controllers/FileDownloadController.php
 use App\Exports\DeviceImportTemplateExport;
 use App\Traits\RespondsWithHttpStatus;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Maatwebsite\Excel\Facades\Excel;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;

 class FileDownloadController extends Controller
 {

Source: GitHub Commit d133a466. The fix constrains export downloads to the exports directory and introduces typed request handling to validate input before serving files.

Detection Methods for CVE-2026-64826

Indicators of Compromise

HTTP GET requests to rConfig download endpoints containing ../, ..%2f, or URL-encoded traversal sequences in the filename parameter
Requests where the filename parameter references sensitive files such as .env, config/database.php, /etc/passwd, or Laravel storage paths
Unexpected 200 OK responses from the download_export route with non-export file content types or sizes

Detection Strategies

Inspect web server access logs for the download_export route with parameter values containing traversal characters or absolute path prefixes
Deploy WAF rules that block directory traversal patterns targeting rConfig download endpoints
Alert on authenticated rConfig sessions issuing repeated download requests to non-standard filenames

Monitoring Recommendations

Enable Laravel request logging on the FileDownloadController routes and forward logs to a central analytics platform
Monitor filesystem access patterns for the web server user reading files outside the rConfig exports/ directory
Track rotation of secrets in .env if exploitation is suspected, including APP_KEY, database passwords, and SMTP credentials

How to Mitigate CVE-2026-64826

Immediate Actions Required

Upgrade rConfig to version 8.2.13 or later, which contains the official fix
Rotate all secrets stored in the rConfig .env file, including APP_KEY, database credentials, and mail configuration
Review web server access logs for prior exploitation attempts using traversal sequences in the filename parameter
Restrict network access to the rConfig management interface to trusted administrative networks

Patch Information

The fix is available in rConfig 8.2.13. See the GitHub Release Notes and the corresponding GitHub Pull Request #349. Additional detail is provided in the VulnCheck Path Traversal Advisory.

Workarounds

Place rConfig behind a reverse proxy or WAF that rejects requests containing ../ or URL-encoded traversal sequences in query parameters
Restrict filesystem permissions so the web server user cannot read the .env file or other sensitive paths outside the exports directory
Limit rConfig account provisioning and audit existing users, since exploitation requires authentication

bash

# Example nginx rule to block traversal patterns on the download route
location ~* /download_export {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
}