CyberRota Analysis
AI-GeneratedrConfig versions prior to 8.2.13 are vulnerable to a path traversal flaw that enables authenticated attackers to access arbitrary files by manipulating the filename parameter in the download_export() method. This vulnerability could lead to exposure of sensitive information, such as encryption keys and database credentials, potentially compromising the application's security. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.