---
id: CVE-2026-73642
title: "Dayforce ESS Excelity is vulnerable to Path Traversal\_ in file download functionality"
summary: "Dayforce ESS Excelity is vulnerable to Path Traversal\_ in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an\_absolute\nlocal file path.\n\n\nThis issue was fixe…"
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'
cwe:
  - CWE-22
vendor: Dayforce
product: Payroll
affected:
  - Payroll R2026.2.0
published: '2026-09-28'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:17:39.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73642'
references:
  - url: 'https://cert.pl/en/posts/2026/09/CVE-2026-73640'
    label: cvd@cert.pl
  - url: 'https://hcm.excelityglobal.com/ESS'
    label: cvd@cert.pl
  - url: 'https://essportal.excelityglobal.com'
    label: cvd@cert.pl
  - url: 'https://cert.pl/en/posts/2026/08/CVE-2026-73640'
    label: cvd@cert.pl
  - url: 'https://www.dayforce.com/how-we-help/dayforce/payroll-solutions'
    label: cvd@cert.pl
tags:
  - nvd
  - cve.org
epss: 0.00424
epssPercentile: 0.36516
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-28T17:57:33.458358Z'
cvssSource: cna
ingestedAt: '2026-09-28T14:12:02.173Z'
---

## Overview

Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute
local file path.


This issue was fixed in version V4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.