Improper limitation of a pathname to a restricted directory

Fortinet PSIRT feed containing multiple 2026 vulnerabilities across FortiOS, FortiProxy, FortiWeb, FortiManager, FortiSandbox, FortiSIEM, FortiClient, FortiPAM, FortiMonitorOnSight and related products. The most urgent issue is FG-IR-26-175, a CVSS 9.8 path traversal and NULL-byte flaw allowing unauthenticated arbitrary file writes and reportedly exploited in the wild. Other critical findings include authentication bypasses, forged JWT authentication, arbitrary code execution, sensitive-information exposure, and remote impersonation. The feed also references OpenSSL CVE-2022-0778 and Apache CV