CVE-2026-34790 is a path traversal vulnerability in Endian Firewall version 3.3.25 and prior. Authenticated users can exploit improper sanitization of the remove ARCHIVE parameter in the /cgi-bin/backup.cgi script to delete arbitrary files on the system. The parameter value is used directly in a file path construction without filtering directory traversal sequences, which leads to an unlink() call on unintended files. This vulnerability is classified under CWE-22 and has a CVSS 4.0 base score of 7.1, reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity.

An authenticated attacker can delete arbitrary files on the Endian Firewall system by exploiting the path traversal vulnerability. This can lead to denial of service or disruption of firewall functionality if critical files are removed. The vulnerability affects system integrity but does not indicate direct confidentiality or availability impact in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to the /cgi-bin/backup.cgi endpoint. Avoid exposing the management interface to untrusted networks.