The vulnerability allows an authenticated user to download files from the server by sending a crafted filename to the export download endpoint. The flaw is a classic path traversal (CWE-22) that bypasses the intended export directory and grants access to any file readable by the application process. The result is disclosure of arbitrary files, which can contain configuration, credentials, or other sensitive data, thereby compromising confidentiality and potentially enabling further attacks.

The affected product is rConfig Community/Enterprise, versions earlier than core 8.2.13. No specific subproduct or version range details are given beyond the cut-off of 8.2.13. Users running any rConfig build prior to this release are at risk.

The CVSS score is 7.1, indicating a high severity. EPSS is unavailable, so exploitation probability cannot be quantified, but the vulnerability is not listed in CISA KEV, suggesting no known active exploits yet. The attack requires authentication and the ability to submit a filename parameter; once that is satisfied, the attacker can read any file that the application can access. The threat is significant for environments where sensitive files are stored on the same host as rConfig and permission checks are not stricter than the application’s own file system rights.