Unauthenticated FortiMai path traversal may allow command execution
Original title: Improper limitation of a pathname to a restricted directory
Fortinet scores the issue CVSS 7.5; the November 10 revision does not list versions or attacks.
Fortinet PSIRT reports a CWE-22 path-traversal flaw in FortiMai. An unauthenticated attacker may execute unauthorized commands through crafted requests. The advisory, FG-IR-26-205, was revised on November 10, 2026. The snippet gives no affected or fixed versions.
Unconfirmed: Affected versions, fixes, and exploitation status are not in the snippet.
- CVSSv3 score is 7.5.
- The attacker does not need to authenticate.
- The weakness is classified as CWE-22.
- Product name in the advisory is FortiMai.
Impact: unauthenticated execution of unauthorized commands
| Product | Affected |
|---|---|
| Fortinet FortiMai | — |
From the original article
CVSSv3 Score: 7. 5 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiMai may allow an unauthenticated attacker to execute unauthorized commands via crafted requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.