FortiManager and FortiAnalyzer path traversal lets admins write files
Original title: Improper limitation of a pathname to a restricted directory in apache_mod
A crafted archive is the stated vector, CVSS is 7.2, and both Cloud products are in scope.
Fortinet PSIRT reports a CWE-22 path-traversal issue, titled as affecting apache_mod, in FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer Cloud. An authenticated administrator may write arbitrary files by sending a specially crafted archive. The advisory FG-IR-26-250 was revised on November 10, 2026.
Unconfirmed: The snippet does not state versions, a fix, or known exploitation.
- CVSSv3 score is 7.2.
- The write path uses a specially crafted archive.
- The advisory title names apache_mod.
- No fixed version appears in the snippet.
Impact: authenticated administrator can write arbitrary files
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 A Path Traversal vulnerability [CWE-22] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to write arbitrary files via a specially crafted archive. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.