Rconfig

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

Published: 2026-08-12T20:44:33.770Z
Updated: 2026-08-14T16:50:37.632Z

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.

Published: 2020-03-20T17:42:54.000Z
Updated: 2024-08-04T10:26:16.079Z

An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file.

Published: 2021-08-20T18:10:54.000Z
Updated: 2024-08-04T16:18:44.442Z

rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.

Published: 2020-10-19T12:54:26.000Z
Updated: 2024-08-04T12:25:16.477Z

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.

Published: 2020-11-13T19:53:36.000Z
Updated: 2024-08-04T12:25:16.366Z