CVE-2026-77914
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to...
CVE-2026-77914 has been rejected by its source and should not be treated as a live vulnerability, published August 24, 2026. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile.
- Severity
- 7.1 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- 0.72%EPSS, 54th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-64826.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
GitHub Advisories Score usedGHSA-6928-5hpx-7r3v
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to...
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.
- Record
GHSA-6928-5hpx-7r3v- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-64826.
- Record
CVE-2026-77914- Updated
- 2026-11-09
EUVDEUVD-2026-64952
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-64826.
- Record
EUVD-2026-64952- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-09
NVDNo score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-64826.
- Record
CVE-2026-77914- Updated
- 2026-11-09
OSV
rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.
- Record
CVE-2026-77914- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| description, products, references, severity, status, title | CVE List | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/rconfig/rconfig/security/advisories/GHSA-m5rw-jcrm-mmwc
nvd.nist.gov/vuln/detail/CVE-2026-77914
vulncheck.com/advisories/rconfig-v8-core-path-traversal-via-export-download-endpoint