CVE-2026-34790 Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal
Authenticated attackers can delete arbitrary files on Endian Firewall via directory traversal in the backup CGI script.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34790?
CVE-2026-34790 is a high-severity path traversal vulnerability in Endian Firewall, published on 2 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.
Weakness: CWE-22
Which versions are affected by CVE-2026-34790?
It affects 1 product.
Products include Endian Firewall Community.
How do I fix CVE-2026-34790?
No fix has been published for CVE-2026-34790 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-34790 being exploited?
There is no known exploitation of CVE-2026-34790 in the wild and no public exploit code.
Other vulnerabilities in Endian Firewall
- CVE-2021-27201 Command injection in n/a
- CVE-2026-34791 Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection
- CVE-2026-34792 Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection
- CVE-2026-34793 Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection
- CVE-2026-34794 Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection
Sources
Also known as GHSA-757j-pp37-wg8v.