The vulnerability allows an authenticated attacker to supply a malicious filename containing directory traversal sequences to the download_export() GET parameter, causing the application to read arbitrary files from the server’s filesystem. The primary impact is unauthorized disclosure of sensitive data such as environment variables, encryption keys, database credentials, and other configuration files. This weakness is identified as CWE-22, indicating a failure to properly validate or sanitize file paths. The attack does not give code execution privileges; however, obtaining configuration secrets can facilitate further compromises.

The affected vendor and product are rConfig, specifically all releases prior to version 8.2.13. No additional sub‑products or version ranges are enumerated beyond this cutoff. Administrators should verify that their deployed rConfig instances are older than or equal to 8.2.12 and plan an upgrade accordingly.

The CVSS score of 7.1 positions this vulnerability in the high severity range, indicating significant risk if the flaw is exploited. The EPSS score is not available, so the likelihood of exploitation is indeterminate, but the lack of a KEV listing suggests no currently documented public exploit. The attack vector requires the attacker to be authenticated to the rConfig web interface, meaning successful exploitation depends on account compromise or weak credentials. Given the potential to read configuration files, the risk to confidentiality is substantial, especially if attackers can curry out lateral movement or elevate privileges.