CVE-2026-74236

GFI Exinda AI and ClearView network monitoring appliances before version 7.6.5 contain a path traversal flaw (CWE-22) in the diagnostic file deletion handler, where the unlink_or_email_file() function appends the values of parameters prefixed with v_file_row_ directly onto a base directory path without sanitization. An authenticated attacker with Admin privileges can send a crafted request embedding traversal sequences in those parameters, causing the appliance to resolve and delete files outside the intended diagnostics directory. Because the deletion runs in the context of root, the attacker can remove arbitrary files anywhere on the appliance's filesystem, driving high integrity and availability impact (CVSS 4.0 rated 7.0 High) with no confidentiality impact per the scoring. Any organization running affected versions of GFI Exinda AI or ClearView is exposed through the appliance's web management interface, though exploitation requires valid Admin credentials. There is currently no known exploitation in the wild, no public proof of concept, and a low EPSS probability of 0.6% within 30 days.

What to do: Upgrade GFI Exinda AI and ClearView to version 7.6.5 or later; until then, limit and closely control which accounts hold Admin privileges on the appliance's management interface. Check appliance logs for requests containing unusual v_file_row_ parameter values (e.g., traversal sequences) and for unexpected file deletions, since successful abuse executes as root and could render the appliance inoperable.