CVE-2026-34790 is a path traversal vulnerability (CWE-22) affecting Endian Firewall version 3.3.25 and prior. Authenticated users can supply directory traversal sequences in the remove ARCHIVE parameter to the /cgi-bin/backup.cgi script, which is used directly in an unlink() system call without sanitization. This allows deletion of arbitrary files on the affected system, potentially impacting system integrity and availability. The vulnerability requires low attack complexity and no user interaction but does require authenticated access.

Successful exploitation allows an authenticated attacker to delete arbitrary files on the Endian Firewall system. This can lead to denial of service or disruption of firewall functionality by removing critical files. The vulnerability does not allow remote code execution or privilege escalation directly but can impact system stability and security posture.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to the /cgi-bin/backup.cgi endpoint. Consider implementing compensating controls such as application-level filtering or file system permissions to limit the impact of potential exploitation.