CVE-2026-34790 in Firewall

Sumário (Inglês)

Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Responsável

VulnCheck

Reservar

30/03/2026

Divulgação

02/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354893	Endian Firewall Parameter backup.cgi unlink Travessia de Diretório	22	Não definido	Não definido	CVE-2026-34790

Fontes

• MITRE
• NVD
• CVE Details