CVE-2026-13224: Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
Published Sep 29, 2026
·Updated
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.5.21
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Remediation
Information
Fireware OS 12.5.21, Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3
Patch Available
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated as an administrator in the Fireware OS WebUI management agent. The available information does not indicate that unauthenticated users can exploit it.
2
What access does successful exploitation provide?
A successful attacker can read or list arbitrary files on the local filesystem by sending a specially crafted management request.