CVE-2026-74236 — GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters …
Published: 2026-09-04 · CVSS: 7.0 · CVSS 4.0
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7