Improper limitation of a pathname to a restricted directory
2026-10-12T08:52:17Z•0093fcd935d941c1f2f8b3a6c823ce1b040618b0a30707177c7cba80ff52179f
CVE-2022-0778CVE-2026-49975CWE-158CWE-22CWE-284CWE-287CWE-77FortiClientFortiManagerFortiOSFortiPAMFortiProxyFortiSIEMFortiSandboxFortiWebFortinetOpenSSLPSIRTactively exploitedarbitrary file writeauthentication bypasscommand injectiondenial of serviceimproper access controlinformation disclosurepath traversalremote code execution
What happened
Fortinet PSIRT feed containing numerous vulnerabilities across FortiOS, FortiProxy, FortiSandbox, FortiManager, FortiClient, FortiSIEM, FortiWeb, FortiPAM, FortiMonitorOnSight, and related products. The most urgent item is a CVSS 9.8 path traversal and null-byte flaw reportedly exploited in the wild, allowing unauthenticated arbitrary file writes. Other notable issues include authentication bypasses, arbitrary code execution, sensitive information disclosure, SSRF, WAF evasion, denial of service, and certificate-validation weaknesses. The feed also references CVE-2022-0778 in OpenSSL and CVE-—
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 0093fcd935d941c1f2f8b3a6c823ce1b040618b0a30707177c7cba80ff52179f
- Enrichment time
- 2026-10-12T08:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.