CVE-2026-74235: GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload() function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can read arbitrary files from the system in the context of root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Exinda AI / ClearViewto a version that resolves this vulnerability.Fixed in 7.6.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated to GFI Exinda AI with Admin privileges. The vulnerable handler is reachable over the network, but no user interaction is required.
What is the impact of successful exploitation?
An Admin-level attacker can use directory traversal sequences in v_del_ parameter values to read arbitrary files from the system. Files are accessed in the context of root, which may expose sensitive system or application data.
Which versions are affected?
GFI Exinda AI versions before 7.6.5 are affected. Updating to 7.6.5 or later addresses the affected version range identified here.
What can be done if an update cannot be applied immediately?
Restrict Admin access to trusted users and limit network access to the management interface. Because exploitation requires Admin authentication, reviewing and reducing unnecessary Admin accounts can reduce exposure.