Improper limitation of a pathname to a restricted directory
2026-10-02T20:52:16Z•3e5374490a24f94040e5e8cc0ac339058d4128a329b28b49c8c385381f36f4f6
CVE-2022-0778CVE-2026-49975CWE-158CWE-22CWE-284CWE-287CWE-288CWE-295FortiClientFortiManagerFortiOSFortiPAMFortiProxyFortiSASEFortiSIEMFortiSandboxFortiWebFortinetPSIRTWAF-evasionaccess-controlarbitrary-file-writeauthentication-bypasscertificate-validationdenial-of-servicepath-traversalremote-code-execution
What happened
Fortinet PSIRT feed containing multiple vulnerabilities across FortiOS, FortiProxy, FortiClient, FortiSandbox, FortiManager, FortiSIEM, FortiWeb, FortiPAM, FortiMonitorOnSight, and related products. The most serious issue is an actively exploited unauthenticated path traversal and null-byte flaw allowing arbitrary file writes. Other high-impact issues include authentication bypasses, forged JWT authentication, unauthenticated sensitive-information exposure, remote code execution, and certificate-validation weaknesses. The feed also references OpenSSL CVE-2022-0778 and Apache HTTP Server CVE-ок
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 3e5374490a24f94040e5e8cc0ac339058d4128a329b28b49c8c385381f36f4f6
- Enrichment time
- 2026-10-02T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.