CVE-2026-74236: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GFI Software GFI Exinda AI

CVE-2026-74236 is a path traversal vulnerability in GFI Software's GFI Exinda AI and ClearView products prior to version 7.6.5. The vulnerability exists in the unlink_or_email_file() function, which handles diagnostic file deletion. It accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing directory traversal sequences. An attacker with authenticated Admin privileges can exploit this to delete arbitrary files on the system with root privileges. The vulnerability has a CVSS 4.0 score of 7.0, indicating high severity. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

An authenticated attacker with Admin privileges can delete arbitrary files on the affected system with root-level permissions. This could lead to denial of service or manipulation of critical system files, impacting system integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Admin access to trusted users only and monitor for suspicious activity related to file deletion operations.