Description

GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T13:20:08.420Z",
  "pubdate": "2026-09-04T13:20:08.420Z",
  "executiveSummary": "A critical path traversal vulnerability exists in GFI Exinda AI versions prior to 7.6.5, specifically within the diagnostic file deletion handler.\nThe vulnerability allows an authenticated attacker possessing administrative privileges to perform arbitrary file deletion operations across the underlying filesystem.\nBecause the affected diagnostic process operates with root-level privileges, the exploitation of this flaw can result in significant system instability or complete service compromise by deleting critical configuration or system files.\nThe root cause is identified as improper neutralization of special elements used in pathnames within the unlink_or_email_file() function.\nSuccessful exploitation requires valid administrative session credentials, highlighting the necessity of strict access control and robust input validation even for internal administrative interfaces.",
  "technicalDetails": "The vulnerability is localized within the diagnostic management module of GFI Exinda AI, specifically inside the unlink_or_email_file() function. This function is responsible for managing the removal of diagnostic log files generated during system troubleshooting.\nThe flaw manifests due to a failure in sanitizing user-supplied input parameters prefixed with v_file_row_. These parameters are concatenated directly onto a predefined base directory path without verification or filtering for directory traversal sequences such as '../'.\nAn authenticated attacker with administrative privileges can craft a malicious request where the parameter value contains traversal sequences, effectively breaking out of the intended diagnostic directory and enabling the specification of arbitrary file paths on the local filesystem.\nWhen the unlink_or_email_file() function is invoked with these malicious inputs, the system performs a file deletion operation on the target path resolved by the concatenation. Because the web application process responsible for this handler executes with root privileges, the attacker-controlled 'unlink' operation carries these elevated permissions.\nThe attack flow proceeds as follows: First, the attacker identifies a legitimate request handled by the diagnostic file deletion handler. Second, the attacker intercepts or crafts a POST request, injecting path traversal sequences into the v_file_row_ parameters. Third, the application backend processes these strings, resolving the path to a sensitive file outside the target directory. Fourth, the unlink_or_email_file() function executes the deletion command as root. Finally, the targeted file is removed from the filesystem.\nThis vulnerability allows for the deletion of essential operating system binaries, configuration files, or data stores. Beyond immediate service disruption, this could be leveraged as part of a multi-stage attack to disable security auditing logs or force the system into a degraded state, facilitating further unauthorized activities or persistent denial of service."
}