CVE-2026-73642
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality
- Risk score
- 67/100
- CVSS
- 9.2 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.2 critical
- Remotely exploitable without logging in
References
Original description
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.
Last activity 28 Sep 2026. Patch Forecast updates every hour.