MEDIUM 6.9 NVD
CVE-2026-74235
GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function
GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function accepts parameters prefixed with v_del_ and appends their values directly to the base configuration directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can read arbitrary files from the system in the context of root.
References
- https://gfi.ai/products-and-solutions/network-management-solutions/exinda-networkorchestra
- https://www.vulncheck.com/advisories/gfi-exinda-ai-path-traversal-via-configuration-downlo
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-09-04 via NVD.
vulnfeed aggregates 8217 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.