FG-IR-26-190: Arbitrary file write and delete in JSON API
Published Nov 10, 2026
·Updated
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Affected Software
9 affected componentsFixes available
Fortinet FortiAnalyzer>=7.6.0<=7.6.4
Fortinet FortiAnalyzer>=7.4.0<=7.4.7
Fortinet FortiAnalyzer>=7.2.0<=7.2.11
Fortinet FortiManager>=7.6.0<=7.6.4
Fortinet FortiManager>=7.4.0<=7.4.7
Fortinet FortiManager>=7.2.0<=7.2.11
Fortinet FortiManager Cloud>=7.6.0<=7.6.4
Fortinet FortiManager Cloud>=7.4.1<=7.4.7
Fortinet FortiManager Cloud>=7.2.1<=7.2.10
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software