CVE-2026-74236CWE-22path-traversal

CVE-2026-74236

Medium · published September 4, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
60.3
In the wild
Unconfirmed
What it is

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00931 · 60.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T17:20Z
References (2)
https://gfi.ai/products-and-solutions/network-management-solutions/exinda-networkorchestrator/resources/documentation/product-releases · [email protected]https://www.vulncheck.com/advisories/gfi-exinda-ai-clearview-path-traversal-via-diagnostic-file-deletion-handler · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 04 SEP 12:23Z
    GFI Exinda AI < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
    cvelistv5