Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.5, 7.4.0 – ≤ 7.4.13, 7.2.0 – ≤ 7.2.16, 7.0.0 – ≤ 7.0.23 | — |
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.9, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.19, 6.4.0 – ≤ 6.4.16 | — |
| Fortinet | FortiPAM | 1.8.0, 1.7.0 – ≤ 1.7.2, 1.6.0 – ≤ 1.6.2, 1.5.0 – ≤ 1.5.1, 1.4.0 – ≤ 1.4.3, 1.3.0 – ≤ 1.3.1, 1.2.0, 1.1.0 – ≤ 1.1.2, 1.0.0 – ≤ 1.0.3 | — |
Advisories 5
- SSA-127084 SSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Nov 10, 2026
- ICSA-26-225-06 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Aug 12, 2026
- NCSC-2026-0282 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 11, 2026
- NCSC-2026-0240 Kwetsbaarheden verholpen in meerdere Fortinet producten NCSC-NL (Netherlands) · Jul 15, 2026
- WID-SEC-2026-2328 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 14, 2026