FG-IR-26-237: Improper limitation of a pathname to a restricted directory
Published Nov 10, 2026
·Updated
An Improper Limitation of a Pathname to a Restricted Directory (CWE-22) vulnerability in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests.
Affected Software
8 affected componentsFixes available
Fortinet FortiAnalyzer>=8.0.0<=8.0.1
Fortinet FortiAnalyzer>=7.6.3<=7.6.7
Fortinet FortiAnalyzer Cloud>=8.0.0<=8.0.1
Fortinet FortiAnalyzer Cloud>=7.6.3<=7.6.7
Fortinet FortiManager>=8.0.0<=8.0.1
Fortinet FortiManager>=7.6.3<=7.6.7
Fortinet FortiManager Cloud>=8.0.0<=8.0.1
Fortinet FortiManager Cloud>=7.6.3<=7.6.7
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software