CVE-2026-39814: Path Traversal
Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.13, FortiWeb 7.2.7 through 7.2.13, FortiWeb 7.0.10 through 7.0.12 may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiWebto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiWebto a version that resolves this vulnerability.Fixed in 8.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39814?
CVE-2026-39814 has a high severity rating due to its potential for unauthorized code execution.
How do I fix CVE-2026-39814?
To fix CVE-2026-39814, upgrade FortiWeb to the latest version or apply the provided patches.
Which versions are affected by CVE-2026-39814?
CVE-2026-39814 affects FortiWeb versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.1 through 7.4.12, 7.2.7 through 7.2.12, and 7.0.10 through 7.0.12.
What type of vulnerability is CVE-2026-39814?
CVE-2026-39814 is classified as a relative path traversal vulnerability.
What could an attacker achieve by exploiting CVE-2026-39814?
An attacker exploiting CVE-2026-39814 could execute unauthorized code or commands on the affected FortiWeb systems.