High severity7.1NVD Advisory· Published Apr 2, 2026· Updated Apr 7, 2026
CVE-2026-34790
CVE-2026-34790
Description
Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.vulncheck.com/advisories/endian-firewall-cgi-bin-backup-cgi-remove-archive-directory-traversalnvdThird Party Advisory
- help.endian.com/hc/en-us/sections/360004371358-CommunitynvdRelease Notes
News mentions
0No linked articles in our index yet.