Executive brief
GFI Exinda AI and ClearView are network management and orchestration solutions used to monitor and control enterprise networks. A path traversal vulnerability in the configuration download function allows authenticated administrators to read arbitrary files from the system with root-level access, potentially exposing sensitive configuration data, credentials, and other confidential information stored on the server.
Technical details
The vulnerability is a path traversal (CWE-22) in the wcf_handle_download() function. The function accepts parameters prefixed with v_del_ and concatenates their values directly to a base configuration directory path without sanitizing directory traversal sequences (e.g., ../). An authenticated attacker with Admin privileges can craft requests to read arbitrary files from the system in the root context. The attack requires authentication and administrative privileges, and no user interaction is needed. The vulnerability is fixed in version 7.6.5 and later.
Affected products
- GFI Exinda AI before 7.6.5
- GFI ClearView before 7.6.5
Timeline
- 2026-09-04: disclosed: Published on NVD