CVE-2026-74236

Name of the Vulnerable Software and Affected Versions GFI Exinda AI versions prior to 7.6.5 GFI ClearView versions prior to 7.6.5

Description A path traversal issue exists in the diagnostic file deletion handler. The unlink or email file() function processes parameters prefixed with v file row and appends their values to a base directory path without sanitizing for directory traversal sequences. This allows an authenticated attacker with Admin privileges to delete arbitrary files from the system with root permissions.

Recommendations Update GFI Exinda AI to version 7.6.5 or later. Update GFI ClearView to version 7.6.5 or later.