CVE-2026-74236: GFI Exinda AI < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlinkoremailfile() function accepts parameters prefixed with vfilerow and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Exinda AIto a version that resolves this vulnerability.Fixed in 7.6.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to GFI Exinda AI and have Admin privileges. Exploitation does not require user interaction and can be performed remotely over the network.
What is the impact of successful exploitation?
An attacker can use directory traversal sequences in v_file_row_ parameter values to delete arbitrary files. The deletion occurs in the context of root, which can affect system integrity and availability.
Which versions are affected?
GFI Exinda AI versions before 7.6.5 are affected. Upgrading to 7.6.5 or later addresses the affected version range described.