CVE-2026-74236
GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.
| CWE | CWE-22 |
| Vendor | gfi software |
| Product | gfi exinda ai |
| Published | Sep 4, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for gfi software gfi exinda ai
Be the first to know when new medium vulnerabilities affecting gfi software gfi exinda ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
GFI Software / GFI Exinda AI
0 < 7.6.5
GFI Software / GFI ClearView
0 < 7.6.5
References
Credits
Alex Williams of Pellera Technologies VulnCheck