Vulnerability · Published Apr 14, 2026 · Assigned by fortinet
CVE-2026-25691
Medium 6.2
In plain English
A medium-severity path traversal in FortiSandbox from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiSandbox PaaS | 5.0.4 |
| Fortinet | FortiSandbox Cloud | 5.0.4 |
| Fortinet | FortiSandbox | 5.0.0 – through 5.0.54.4.0 – through 4.4.84.2.1 – through 4.2.8 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H/E:F/RL:O/RC:C