EUVD-2026-22321Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5 all versions, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform path traversal attack via File Content Extraction actions.
AnalysisAI
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.3) contains a path traversal vulnerability in File Content Extraction actions that allows authenticated remote attackers to read arbitrary files outside the intended directory with high confidentiality impact. The vulnerability requires valid credentials and is exploitable over the network with no user interaction; CVSS 6.5 reflects medium-to-high severity for a cloud security platform handling sensitive workflows.
Technical ContextAI
FortiSOAR is a cloud-native security orchestration, automation, and response (SOAR) platform. The vulnerability resides in the File Content Extraction action workflow component, which fails to properly validate and restrict file path inputs, enabling directory traversal via path manipulation sequences (e.g., '../' or absolute path references). This is a classic CWE-22 pathname validation bypass allowing an authenticated user to escape the intended file storage directory and access system or application files. Both PaaS (multi-tenant cloud) and on-premise (self-hosted) deployments share the same vulnerable code path.
RemediationAI
Upgrade FortiSOAR on-premise and PaaS deployments to versions 7.6.4 or later, 7.5.4 or later, and 7.4.6 or later as released by Fortinet. For organizations unable to patch immediately, restrict access to File Content Extraction actions through role-based access controls to only trusted administrators, and monitor audit logs for unusual file access patterns via the FortiSOAR workflow engine. Consult Fortinet Security Advisory FG-IR-26-116 at https://fortiguard.fortinet.com/psirt/FG-IR-26-116 for patch availability and detailed upgrade instructions specific to your deployment model.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today