CVE-2026-77914 Overview
CVE-2026-77914 is a path traversal vulnerability [CWE-22] in rConfig Core versions 8.0.0 through 8.2.12. The flaw resides in the export download endpoint, which fails to sanitize the filename parameter. Authenticated users can supply crafted filenames containing directory traversal sequences to escape the intended export directory. Successful exploitation lets attackers read arbitrary files that are readable by the application process, including configuration files, credentials, and sensitive network device backups managed by rConfig.
Critical Impact
Authenticated attackers can read arbitrary files on the rConfig host, exposing credentials and network device configurations processed by the application.
Affected Products
- rConfig Core 8.0.0 through 8.2.12
- Fixed in rConfig Core 8.2.13
- Deployments exposing the export download endpoint to authenticated users
Discovery Timeline
- 2026-08-24 - CVE-2026-77914 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-77914
Vulnerability Analysis
rConfig is a network device configuration management tool used to back up and audit device configurations. The export download endpoint accepts a filename parameter that the application resolves against an export directory before returning the file contents to the client. The endpoint does not canonicalize the supplied path or validate that the resolved location remains within the intended export directory.
An authenticated user can insert ../ sequences into the filename parameter to traverse outside the export directory. Because rConfig stores network device backups, database credentials, and application secrets on the same host, exposed files often include high-value material. The application process typically runs with sufficient privileges to read configuration files, log data, and other assets in the web root.
Root Cause
The root cause is missing input validation on the filename parameter combined with unsafe path concatenation. The download handler joins user input directly with the export directory path and passes the result to the file read routine without performing a realpath check or rejecting traversal characters. This maps directly to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires network access to the rConfig web interface and valid application credentials. An attacker with any authenticated session sends a request to the export download endpoint with the filename parameter set to a traversal string such as ../../../../etc/passwd or a path pointing to config.php. The server resolves the path, reads the target file, and returns its contents in the HTTP response. No user interaction is required beyond the initial authentication. Refer to the VulnCheck RConfig Path Traversal Advisory and the GitHub Security Advisory GHSA-m5rw-jcrm-mmwc for endpoint-level technical details.
Detection Methods for CVE-2026-77914
Indicators of Compromise
- HTTP requests to the rConfig export download endpoint containing ../, ..%2f, or URL-encoded traversal sequences in the filename parameter
- Web server or application logs showing successful 200 responses for filename values referencing paths outside the configured export directory
- Unexpected reads of config.php, .env, /etc/passwd, or rConfig database configuration files by the web server user
Detection Strategies
- Parse rConfig and reverse proxy access logs for the export download route and alert on any filename value containing traversal metacharacters or absolute paths
- Deploy web application firewall rules that block traversal patterns on rConfig endpoints, including double-encoded variants such as %252e%252e%252f
- Correlate authenticated rConfig sessions with file access patterns to identify accounts issuing anomalous download volumes
Monitoring Recommendations
- Enable verbose HTTP logging on the rConfig host and forward events to a centralized SIEM for retention and analysis
- Baseline normal export activity by user and alert on deviations in download frequency or target filenames
- Monitor filesystem access to sensitive paths such as /etc, the rConfig install directory, and any backup storage locations
How to Mitigate CVE-2026-77914
Immediate Actions Required
- Upgrade rConfig Core to version 8.2.13 or later, which contains the fix referenced in the GitHub Release 8.2.13 notes
- Restrict network access to the rConfig web interface to trusted administrative networks and VPN endpoints
- Audit rConfig user accounts, disable unused credentials, and rotate any secrets that may have been exposed while a vulnerable version was reachable
Patch Information
The rConfig maintainers released version 8.2.13 to address CVE-2026-77914. The patch adds validation on the export download endpoint to reject traversal sequences and constrain resolved paths to the export directory. Details are published in the GitHub Security Advisory GHSA-m5rw-jcrm-mmwc.
Workarounds
- Place a reverse proxy or web application firewall in front of rConfig and block requests to the export download endpoint containing .., encoded traversal sequences, or absolute paths
- Run the rConfig application process under a dedicated low-privilege account with filesystem permissions limited to the application and export directories
- Temporarily disable the export download feature for non-administrative roles until the upgrade to 8.2.13 is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
