{"id":"CVE-2026-73642","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-73642","generatedAt":"2026-10-28T04:13:38.032Z","title":"Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality.","description":"Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute\nlocal file path.\n\n\nThis issue was fixed in version V4.","published":"2026-09-28T14:17:17.000Z","lastModified":"2026-10-13T14:17:39.000Z","status":"Deferred","sourceIdentifier":"cvd@cert.pl","cvss":{"version":"4.0","score":9.2,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00424,"percentile":0.36516,"date":"2026-10-27","history":[{"date":"2026-09-29","score":0.00424,"percentile":0.34246}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-28T14:17:17.000Z","detail":{"score":"9.2","severity":"CRITICAL","publishedAt":"2026-09-28T14:17:17.160Z"},"summary":"New CVE, critical severity (CVSS 9.2)."}],"references":[{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-73640","source":"cvd@cert.pl"},{"url":"https://hcm.excelityglobal.com/ESS","source":"cvd@cert.pl"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-73642","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}