Rconfig vulnerabilities
Published CVEs affecting Rconfig products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-77915
Critical · 9.8
CWE-306 Aug 24, 2026
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
CVE-2026-77914
Medium · 6.5
CWE-22 Aug 24, 2026
rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process.
CVE-2026-63102
Medium · 5.4
CWE-915 Jul 20, 2026
rConfig Core < 8.2.8 Privilege Escalation via Users API role field
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.
CVE-2020-10221
High · 8.8
KEV High · 68 Public exploit CWE-78 Mar 8, 2020
rConfig OS Command Injection Vulnerability
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.