{"id":"CVE-2026-73642","state":"PUBLISHED","title":"Path Traversal in Dayforce ESS Excelity","description":"Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute\nlocal file path.\n\n\nThis issue was fixed in version V4.","publishedAt":"2026-09-28T13:12:46.426Z","updatedAt":"2026-10-13T13:20:58.581Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Dayforce ESS Excelity"],"affected":[{"vendor":"Dayforce","product":"ESS Excelity","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"V4","versionType":"custom"}]}],"references":["https://cert.pl/en/posts/2026/09/CVE-2026-73640","https://hcm.excelityglobal.com/ESS"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/73xxx/CVE-2026-73642.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-73642","state":"PUBLISHED","datePublished":"2026-09-28T13:12:46.426Z","dateUpdated":"2026-10-13T13:20:58.581Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-08-13T13:42:38.905Z"},"containers":{"cna":{"title":"Path Traversal in Dayforce ESS Excelity","descriptions":[{"lang":"en","value":"Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute\nlocal file path.\n\n\nThis issue was fixed in version V4."}],"affected":[{"vendor":"Dayforce","product":"ESS Excelity","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"V4","versionType":"custom"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-73640","tags":["third-party-advisory"]},{"url":"https://hcm.excelityglobal.com/ESS","tags":["product"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-10-13T13:20:58.581Z"},"datePublic":"2026-09-28T00:00:00.000Z","impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]},{"capecId":"CAPEC-76","descriptions":[{"lang":"en","value":"CAPEC-76 Manipulating Web Input to File System Calls"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dayforce:ess_excelity:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"v4"}]}]}],"credits":[{"lang":"en","value":"Dawid Dudek (4c1d8urn)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-28T17:57:33.458358Z","id":"CVE-2026-73642","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-28T17:57:46.154Z"}}]}}}