CVE-2026-34790CWE-22

Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal

High · published April 2, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00911 · 59.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-02T14:45Z
EPSS history
Timeline
  • 02 APR 14:45Z
    Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal
    cvelistv5