CVE-2026-126255: Path Traversal
A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.4.13 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
Fortinet FortiPAMto a version that resolves this vulnerability.Fixed in 1.9.3 - Upgrade
Upgrade
Fortinet FortiPAMto a version that resolves this vulnerability.Fixed in 1.7.3 - Upgrade
Upgrade
Fortinet FortiPAMto a version that resolves this vulnerability.Fixed in 1.8.5 - Upgrade
Upgrade
Fortinet FortiPAMto a version that resolves this vulnerability.Fixed in 7.0.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, and 7.2.0 through 7.2.13. All versions of FortiPAM 1.0 through 1.6 are listed as affected.
Does exploitation require authentication or user interaction?
No. The vulnerability may be exploited by an unauthenticated attacker, and no user interaction is required. Exploitation requires specially crafted credentials and has high attack complexity.
What is the potential impact of successful exploitation?
Successful exploitation may allow an attacker to bypass authentication. The provided severity vector rates confidentiality and integrity impact as high, with no availability impact indicated.