CVE-2026-73642

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/09/CVE-2026-73640
https://hcm.excelityglobal.com/ESS

Configurations

No configuration.

History

13 Oct 2026, 14:17

Type	Values Removed	Values Added
References	~~{'url': 'https://essportal.excelityglobal.com', 'source': 'cvd@cert.pl'}~~	() https://hcm.excelityglobal.com/ESS -

13 Oct 2026, 13:17

Type	Values Removed	Values Added
References	~~{'url': 'https://cert.pl/en/posts/2026/08/CVE-2026-73640', 'source': 'cvd@cert.pl'}~~ ~~{'url': 'https://www.dayforce.com/how-we-help/dayforce/payroll-solutions', 'source': 'cvd@cert.pl'}~~	() https://cert.pl/en/posts/2026/09/CVE-2026-73640 - () https://essportal.excelityglobal.com -
Summary	(en) Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.	(en) Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

28 Sep 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 14:17

Updated : 2026-10-13 14:17

NVD link : CVE-2026-73642

Mitre link : CVE-2026-73642

CVE.ORG link : CVE-2026-73642

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-73642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T17:57:33.458358Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Dayforce", "product": "ESS Excelity", "versions": [{"status": "affected", "version": "0", "lessThan": "V4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-28T14:17:17.160", "references": [{"url": "https://cert.pl/en/posts/2026/09/CVE-2026-73640", "source": "cvd@cert.pl"}, {"url": "https://hcm.excelityglobal.com/ESS", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Dayforce ESS Excelity is vulnerable to Path Traversal\u00a0 in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an\u00a0absolute\nlocal file path.\n\n\nThis issue was fixed in version V4."}], "lastModified": "2026-10-13T14:17:39.327", "sourceIdentifier": "cvd@cert.pl"}