EUVD-2026-22344Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here>
AnalysisAI
Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve full system compromise. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), the vulnerability permits network-based exploitation without credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of FortiSandbox web management interface or API endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 9.8 reflects maximum exploitability (network vector, low complexity, no authentication, no user interaction) with complete system impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Remote attacker crafts HTTP requests to FortiSandbox's web interface or API containing directory traversal sequences ('../') in file path parameters. Without authentication, the attacker navigates outside intended directories to access sensitive system files, configuration databases containing credentials, or overwrite critical executables. … |
| Remediation | Upgrade FortiSandbox on-premise appliances to versions beyond 5.0.5 or 4.4.8 as specified in Fortinet advisory FG-IR-26-112 (https://fortiguard.fortinet.com/psirt/FG-IR-26-112). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all FortiSandbox deployments running affected versions (4.4.0-4.4.8, 5.0.0-5.0.5) and isolate them from untrusted networks or disable remote access where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today