Vulnerability · Published Apr 2, 2026 · Assigned by VulnCheck
CVE-2026-34790Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal
High 7.1
In plain English
A high-severity path traversal in Endian Firewall from Endian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Endian | Endian Firewall | 0 – through 3.3.25 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
References
- Endian Release Notes release-notes
- VulnCheck Advisory: Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal third-party-advisory