CVE-2026-6074 is a path traversal vulnerability (CWE-35) affecting Intrado 911 Emergency Gateway versions 5.x through 7.x. The issue exists in the download_debuglog_file.php endpoint, which is used to download debug logs. An unauthenticated attacker can exploit this vulnerability by manipulating the 'name' parameter to traverse directories and read arbitrary files outside the intended directory scope. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed by the vendor as of the published date.

An unauthenticated attacker can read arbitrary files on the affected system by exploiting the path traversal vulnerability. This can lead to unauthorized disclosure of sensitive information, potentially affecting system confidentiality, integrity, and availability. The critical CVSS score reflects the severity and ease of exploitation over the network without any authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity. Implement network-level controls to limit exposure of the affected service to untrusted networks.