CyberRota Analysis
AI-GeneratedrConfig versions prior to 8.2.13 are vulnerable to a path traversal flaw that enables authenticated users to access arbitrary files by exploiting crafted filenames in the export download endpoint. This vulnerability could lead to unauthorized data exposure, allowing attackers to read sensitive files outside the intended export directory. Organizations using affected versions should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.