CVE-2026-124079
CriticalCVSS 9.8Summary
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability. An unauthenticated attacker can push a crafted serialized job onto the Redis-backed Laravel Horizon queue, leading to arbitrary code execution via the App\Jobs\TaskDownloadRun class and the bundled laravel/tinker package.
Risk Assessment
Attackers can execute arbitrary PHP and OS commands as the queue worker user, write a persistent web shell, and read database credentials, device credentials, and API tokens. This poses a serious risk of full system compromise and lateral movement.
Recommendation
Update rConfig Core to 8.2.19 or later and rConfig Pro to 8.4.1 or later. Additionally, secure Redis with authentication and restrict network access to the queue.
Other vulnerabilities in rConfig
See all- CVE-2021-29006Medium
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
- CVE-2020-10221HighActively exploited
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
- CVE-2026-64826Medium
rConfig before 8.2.13 has a path traversal vulnerability in the download_export() method, allowing authenticated attackers to read arbitrary files by supplying ../ sequences in the filename parameter. Sensitive files like environment files with encryption keys, database credentials, and mail config can be accessed.
- CVE-2023-39110High
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- CVE-2023-39109High
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- CVE-2023-39108High
In version 3.9.4 of rconfig, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the path_b parameter of the doDiff function in /classes/compareClass.php. This allows authenticated attackers to make arbitrary requests by injecting crafted URLs.
- CVE-2021-29005High
In rConfig 3.9.6, insecure permissions for the chmod command exist. After installation, the apache user can execute chmod as root without a password, allowing a low-privilege attacker to gain root access to the server.
- CVE-2021-29004High
SQL Injection vulnerability in rConfig 3.9.6 allows an authenticated attacker to inject malicious SQL code. If the MySQL server does not have --secure-file-priv set and is on the same host as rConfig, the attacker can upload a webshell and gain remote access.
Original NVD description (English source)
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS