CVE-2026-126220: Improper limitation of a pathname to a restricted directory
Published Nov 10, 2026
·Updated
An External Control of File Name or Path vulnerability [CWE-22] and an Improper Neutralization of Special Elements vulnerability [CWE-74] in FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer Cloud may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
Affected Software
12 affected componentsFixes available
Fortinet FortiAnalyzer=.
Fortinet FortiAnalyzer>=7.6.0<=7.6.7
Fortinet FortiAnalyzer>=7.4.0<=7.4.11
Fortinet FortiAnalyzer Cloud=.
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.11
Fortinet FortiManager=.
Fortinet FortiManager>=7.6.0<=7.6.7
Fortinet FortiManager>=7.4.0<=7.4.11
Fortinet FortiManager Cloud=.
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=7.4.1<=7.4.11
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software