CVE-2026-6074

The vulnerability occurs in the 'name' parameter of the download_debuglog_file.php endpoint, intended for downloading debug log files. An attacker can manipulate the value of this parameter by injecting path traversal sequences (e.g., '../') to exit the intended directory and gain access to arbitrary files in the server file system. The attack requires no authentication — the endpoint is publicly accessible.

An attacker can read arbitrary files from the server file system, including configuration files, credentials, private keys or other sensitive information, which may lead to further system compromise.

Apply patches available from the manufacturer according to the references. Detailed information is available in the ICS-CERT advisory ICSA-26-113-06 published by CISA. As a temporary measure, it is recommended to restrict network access to the download_debuglog_file.php endpoint using firewall or ACL rules.

Intrado 911 Emergency Gateway (EGW) in versions 5.x, 6.x and 7.x