CVE-2026-73642 — Path Traversal in Dayforce ESS Excelity

CVE-2026-73642

Path Traversal in Dayforce ESS Excelity PUBLISHED

Description (CNA)

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

Affected (CNA)

Vendor / product	Versions
Dayforce / ESS Excelity	affected 0 before V4

CWE

CWE-22

References

https://cert.pl/en/posts/2026/09/CVE-2026-73640
https://hcm.excelityglobal.com/ESS

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.