GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 04 Sep 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root. | |
| Title | GFI Exinda AI < 7.6.5 Path Traversal via Diagnostic File Deletion Handler | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-09-04T12:23:04.234Z
Updated: 2026-09-04T12:23:04.234Z
Reserved: 2026-08-14T18:01:19.917Z
Link: CVE-2026-74236
Vulnrichment
No data.
NVD
No data.
Redhat
No data.