CVE-2026-13224: Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
Published Sep 29, 2026
·Updated
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated as an administrator in the Fireware OS WebUI management agent. The available information does not indicate that unauthenticated users can exploit it.
2
What access does successful exploitation provide?
A successful attacker can read or list arbitrary files on the local filesystem by sending a specially crafted management request.