FGFM elevation before registration password is verified
FG-IR-26-275
Summary
CVSSv3 Score:
7.3
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Revised on 2026-11-10 00:00:00
Products covered
FortiManager
FortiAnalyzer
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by Fortinet
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.