CVE-2026-73642 describes a path traversal vulnerability in Dayforce Payroll's file download feature. The flaw allows unauthenticated remote attackers to specify arbitrary file paths, including absolute local paths, via a GET request parameter. This improper limitation of pathname access (CWE-22) can lead to unauthorized file disclosure. Attempts to contact the vendor for remediation information were unsuccessful. The vulnerability is confirmed in version R2026.2.0 but may affect other versions as well. The CVSS 4.0 base score is 9.2, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and system control.

An unauthenticated attacker can remotely access arbitrary files on the Dayforce Payroll server by exploiting the path traversal vulnerability. This can lead to disclosure of sensitive information stored on the system. The vulnerability does not require authentication or user interaction, increasing its risk. There is no indication of privilege escalation or integrity impact, but confidentiality and system control are highly impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since vendor contact attempts were unsuccessful and no patch links are available, organizations should monitor official vendor channels for updates. Until a fix is available, restrict external access to the affected file download functionality if possible and implement network-level controls to limit exposure.