Description

GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function accepts parameters prefixed with v_del_ and appends their values directly to the base configuration directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can read arbitrary files from the system in the context of root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-04T13:20:08.217Z",
  "pubdate": "2026-09-04T13:20:08.217Z",
  "executiveSummary": "A critical path traversal vulnerability exists in GFI Exinda AI versions prior to 7.6.5, specifically within the system maintenance configuration download handler. This flaw allows an authenticated attacker possessing Administrative privileges to perform arbitrary file reads across the underlying filesystem.\nThe vulnerability originates from inadequate input validation and sanitization within the wcf_handle_download() function. By manipulating parameters prefixed with v_del_, an attacker can escape the intended directory boundaries, effectively accessing sensitive system configuration files, logs, or credentials.\nBecause the application operates with root-level process permissions, the scope of this vulnerability encompasses the entire filesystem, posing a severe risk to system integrity and confidentiality. Exploitation is restricted to users who have already achieved Administrative access, meaning this represents a privilege escalation or lateral movement risk rather than an initial remote entry point.\nThe inability to restrict file access to the designated configuration directory allows for complete compromise of system secrets stored on the appliance. Organizations utilizing versions below 7.6.5 are advised to restrict administrative access and apply patches immediately upon availability.",
  "technicalDetails": "The vulnerability resides within the wcf_handle_download() function, which is responsible for processing file download requests during system maintenance tasks. The root cause is the improper handling of user-supplied input parameters that are directly concatenated with a hardcoded base configuration directory path without prior canonicalization or validation.\nSpecifically, the handler accepts input parameters prefixed with the string 'v_del_'. In a typical execution flow, the application interprets the value associated with this prefix as a filename or path relative to the configuration directory. However, the software fails to sanitize these values for directory traversal sequences, such as '../' (dot-dot-slash) characters.\nAn authenticated attacker with Administrative privileges can construct a malicious payload where the 'v_del_' parameter contains a sequence of directory traversal characters. When the wcf_handle_download() function processes this input, it concatenates the traversal sequences onto the base path, causing the filesystem interface to resolve to an arbitrary location outside of the secure configuration directory. Because the GFI Exinda AI service runs with root privileges, the application is capable of reading any file on the system that is accessible to the root user, effectively bypassing the security controls intended to limit file retrieval to exported configuration sets.\nThe exploitation flow is as follows: 1) The attacker authenticates to the GFI Exinda AI web interface with Administrative credentials. 2) The attacker navigates to the maintenance configuration interface. 3) The attacker submits a specially crafted request, injecting '../' sequences into the 'v_del_' parameter to escape the base directory. 4) The application, failing to sanitize the input, resolves the path to a sensitive file (e.g., /etc/shadow or system configuration files containing credentials). 5) The server reads the target file and serves the content back to the attacker, providing unauthorized access to sensitive system data.\nThis vulnerability is particularly severe due to the elevated privilege context of the web application service. Post-exploitation, an attacker can extract cryptographic keys, configuration parameters, or session identifiers, facilitating further internal network reconnaissance or full persistent control over the GFI Exinda appliance."
}