EUVD-2026-22331
GHSA-j3x3-rc9w-wf4m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests.
AnalysisAI
Path traversal vulnerability in Fortinet FortiSandbox allows privileged super-admin users with CLI access to delete arbitrary directories on the system via crafted HTTP requests. Affects FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all versions, FortiSandbox Cloud 5.0.4, and FortiSandbox PaaS 5.0.4. CVSS 6.7 reflects high integrity and availability impact but requires authenticated super-admin privileges; no public exploit code or active KEV designation identified at time of analysis.
Technical ContextAI
The vulnerability exploits improper pathname validation in FortiSandbox's HTTP request handling, allowing directory traversal via malformed paths (CWE-22). The affected FortiSandbox products include the on-premise sandbox appliance (versions 4.2, 4.4.0-4.4.8, 5.0.0-5.0.5), cloud-delivered variant (FortiSandbox Cloud 5.0.4), and platform-as-a-service offering (FortiSandbox PaaS 5.0.4). The vulnerability requires authentication as a super-admin user with direct CLI access, meaning an attacker must already hold administrative credentials and network access to the management interface. The path traversal permits arbitrary directory deletion, enabling destruction of critical system, configuration, or data directories.
RemediationAI
Apply vendor-released patches per Fortiguard FG-IR-26-115. For FortiSandbox on-premise, upgrade to version 4.4.9 or later (4.4 branch) or 5.0.6 or later (5.0 branch); version 4.2 is end-of-life and should be migrated to a supported version. For FortiSandbox Cloud and PaaS, versions beyond 5.0.4 should be deployed automatically by Fortinet; contact Fortinet support if CloudPaaS instances remain on 5.0.4. As an interim control, restrict super-admin CLI and HTTP management access to trusted administrative networks only, disable unnecessary administrative accounts, and monitor access logs for unauthorized super-admin session activity. See https://fortiguard.fortinet.com/psirt/FG-IR-26-115 for patch availability and additional hardening guidance.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today