EUVD-2026-22346
GHSA-6q7w-cjq4-j969
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin credentials
-
DeliveryAuthenticate to FortiWeb admin interface
-
ExploitCraft relative path traversal payload
-
ExecutionExecute arbitrary command or access restricted file
-
ImpactEscalate privileges or maintain persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Impact | CVSS 6.7 reflects high impact (CIA all rated H) but limited exposure: attack vector is local (AV:L), attack complexity is low (AC:L), and privilege requirement is high (PR:H), meaning only administrators can exploit it. EPSS data unavailable. Despite the high CVSS impact rating, real-world risk is constrained by the requirement for high-level local access-an attacker must already possess admin credentials or system access. This is a privilege escalation vector for compromised admin accounts or insider threats, not a vector for external compromise. The lack of public exploit code and absence of CISA KEV status suggest low current exploitation probability, though Fortinet's multi-version affected range indicates the flaw may have existed for years before discovery. Prioritize patching in environments where admin account compromise is plausible. |
| Exploit ScenarioDerived | An attacker with compromised FortiWeb admin credentials logs into the administrative interface and manipulates file path inputs (e.g., in configuration upload, log export, or backup features) to include relative path traversal sequences, allowing them to read or execute files outside the intended directory structure. Because PR:H is required, this is primarily a threat when admin accounts are already compromised or when a malicious insider is present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Local privilege escalation in Fortinet FortiWeb 7.0.10-8.0.2 allows high-privileged local attackers to execute arbitrary code or commands through relative path traversal, exploiting improper file path validation with CVSS 6.7 (high confidentiality, integrity, and availability impact). No public exploit code or active exploitation confirmed at time of analysis.
RemediationAI
Upgrade FortiWeb to patched versions released by Fortinet; consult Fortinet security advisory FG-IR-26-114 (https://fortiguard.fortinet.com/psirt/FG-IR-26-114) for the exact fixed version applicable to your branch. As an interim mitigation, restrict local administrative access to FortiWeb systems and audit admin account activity for suspicious file operations. Implement principle of least privilege for admin roles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-23 (relative path traversal) occurs when an application fails to properly normalize or validate file paths, allowing attackers to reference files or directories outside intended boundaries using relative path components (e.g., '../'). In FortiWeb, an authenticated local administrator can manipulate relative paths during file operations, potentially accessing or executing unauthorized binaries or configuration files. FortiWeb is a web application firewall (WAF) appliance; this vulnerability affects the administrative interface or local system access, not the WAF filtering engine itself. The vulnerability spans multiple major versions (7.0, 7.2, 7.4, 7.6, and 8.0), indicating a systemic path handling flaw rather than a version-specific issue.
Know when Fortiweb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (fortinet) · only source for this CVE.
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12, FortiWeb 7.0.10 through 7.0.12 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version
Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers t
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.1
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attac
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6
Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the
Exploit-DB