EUVD-2026-22346
GHSA-6q7w-cjq4-j969
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12, FortiWeb 7.0.10 through 7.0.12 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Local privilege escalation in Fortinet FortiWeb 7.0.10-8.0.2 allows high-privileged local attackers to execute arbitrary code or commands through relative path traversal, exploiting improper file path validation with CVSS 6.7 (high confidentiality, integrity, and availability impact). No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
CWE-23 (relative path traversal) occurs when an application fails to properly normalize or validate file paths, allowing attackers to reference files or directories outside intended boundaries using relative path components (e.g., '../'). In FortiWeb, an authenticated local administrator can manipulate relative paths during file operations, potentially accessing or executing unauthorized binaries or configuration files. FortiWeb is a web application firewall (WAF) appliance; this vulnerability affects the administrative interface or local system access, not the WAF filtering engine itself. The vulnerability spans multiple major versions (7.0, 7.2, 7.4, 7.6, and 8.0), indicating a systemic path handling flaw rather than a version-specific issue.
RemediationAI
Upgrade FortiWeb to patched versions released by Fortinet; consult Fortinet security advisory FG-IR-26-114 (https://fortiguard.fortinet.com/psirt/FG-IR-26-114) for the exact fixed version applicable to your branch. As an interim mitigation, restrict local administrative access to FortiWeb systems and audit admin account activity for suspicious file operations. Implement principle of least privilege for admin roles.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today