Unauthenticated FortiMail path traversal can execute code, CVSS 9.8
Original title: Improper limitation of a pathname to a restricted directory
FG-IR-26-199 is a CWE-22 flaw; the snippet gives no versions, patch or exploitation status.
Fortinet revised FG-IR-26-199 on November 10. A path-traversal vulnerability in FortiMail, CWE-22, may allow an unauthenticated attacker to execute unauthorized code or commands through crafted requests. Fortinet scores it CVSSv3 9.8. The snippet does not list affected versions, a fixed release or confirmed attacks.
Unconfirmed: No affected versions, fix or in-the-wild exploitation is stated in the snippet.
- The attacker does not need to authenticate.
- The weakness class is CWE-22 path traversal.
- Only FortiMail is named as affected.
- The advisory was revised on November 10, 2026.
Impact: unauthenticated remote code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 9. 8 An Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.