Improper limitation of a pathname to a restricted directory
2026-10-08T20:52:17Z•ac19362624570ef1164c9d009da80eab245c2ab653d16af97afbd43e2a55e278
CVE-2022-0778CVE-2026-49975FortiAnalyzerFortiClientFortiManagerFortiOSFortiPAMFortiProxyFortiSASEFortiSIEMFortiSOARFortiSandboxFortiWebFortinetOpenSSLSSRFWAF bypassaccess controlarbitrary file writeauthentication bypassbuffer overflowcertificate validationcommand injectiondenial of serviceimproper authenticationpath traversalremote code execution
What happened
Fortinet PSIRT feed containing multiple vulnerabilities across FortiOS, FortiProxy, FortiClient, FortiManager, FortiSandbox, FortiSIEM, FortiWeb, FortiSOAR, FortiPAM, FortiMonitorOnSight, FortiAnalyzer, FortiSASE and related components. Issues range from low-severity denial of service, open redirect and header injection to critical unauthenticated authentication bypass, arbitrary file write, sensitive-information exposure and potential remote code execution. The highest-priority item is FG-IR-26-175, a CVSS 9.8 path traversal/null-byte flaw allowing unauthenticated arbitrary file writes and e
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- ac19362624570ef1164c9d009da80eab245c2ab653d16af97afbd43e2a55e278
- Enrichment time
- 2026-10-08T20:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.