The vulnerability CVE-2026-7036 affects Tenda i9 firmware version 1.0.0.5(2204) in the HTTP Handler component's R7WebsSecurityHandlerfunction. It allows remote attackers to perform path traversal attacks by manipulating file path inputs, potentially leading to unauthorized file access. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or patch has been published, and the vendor has not provided remediation details. Exploit code is publicly available but no active exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to access files outside the intended directory structure on the affected Tenda i9 device. This could lead to disclosure of sensitive information or system files. However, the impact is limited by the medium severity rating and the lack of known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying network-level controls to restrict access to the device's management interface may reduce exposure.