CRITICALCVSS 9.2

CVE-2026-73642

CVE-2026-73642 updated by NVD

Published: 2026-09-28
Modified: 2026-10-15
Sources: euvd, nvd

Summary

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73642

Includes data from the ENISA EU Vulnerability Database (EUVD).

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.