CVE-2026-73642 Path Traversal in Dayforce ESS Excelity
Unauthenticated attackers can read arbitrary local files via path traversal in the file download functionality of Dayforce ESS Excelity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73642?
CVE-2026-73642 is a critical path traversal vulnerability in Dayforce ESS Excelity, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path.
This issue was fixed in version V4.
Weakness: CWE-22
Which versions are affected by CVE-2026-73642?
How do I fix CVE-2026-73642?
No fix has been published for CVE-2026-73642 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-73642 being exploited?
There is no known exploitation of CVE-2026-73642 in the wild and no public exploit code.
Sources
Also known as GHSA-p8m3-fq83-fgm7.