Riskcovery

CVE-2026-6074

Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)

State
Published
Severity
9.3 Critical
Published
Apr 23, 2026
Updated
Jun 4, 2026
Reserved
Apr 10, 2026

Read the record on cve.org

Description

Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nicscert
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hicscert

Weaknesses

  • CWE-35 Path traversal: '.../...//'

Affected Products

ProductVersions
911 Emergency GatewayIntrado
  • Versions 7.xAffected
  • Versions 6.xAffected
  • Versions 5.xAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.