FortiManager and FortiAnalyzer API flaw allows file write and delete
Original title: Arbitrary file write and delete in JSON API
A read-only authenticated user can alter filesystem files through crafted HTTP or HTTPS requests; CVSS is 7.3.
Fortinet revised a PSIRT advisory on November 10 covering a path-traversal flaw in the FortiManager and FortiAnalyzer API. An authenticated attacker limited to a read-only profile may write and delete files on the underlying filesystem. No affected versions, fix, CVE, or exploitation status appears in the snippet.
Unconfirmed: Affected versions, fixed releases, a CVE identifier, and exploitation status are not stated.
- The weakness is CWE-22, improper pathname limitation.
- CVSSv3 score is 7.3.
- Requests may be sent over HTTP or HTTPS.
- The advisory was revised on November 10, 2026.
Impact: Authenticated write and delete of filesystem files
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
- Vendors
- Fortinet
- Products
- FortiManagerFortiAnalyzer
From the original article
CVSSv3 Score: 7. 3 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.