CVE-2026-34790 in Firewall
Сводка (Английский)
Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Ответственный
VulnCheck
Резервировать
30.03.2026
Раскрытие
02.04.2026
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 354893 | Endian Firewall Parameter backup.cgi unlink обход каталога | 22 | Не определено | Не определено | CVE-2026-34790 |