fortiguard.fortinet.com
https://fortiguard.fortinet.com/psirt/FG-IR-26-115 CVE-2026-25691
MEDIUM
FortiSandbox Path Traversal Vulnerability
Record summary
CVE-2026-25691 has a selected CVSS score of 6.2 (medium).
Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2026 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
FortiSandboxBrowse Fortinet / FortiSandboxDefault status: unaffected | CVE List | 5.0.0 to ≤ 5.0.5 | affected |
| 4.4.0 to ≤ 4.4.8 | affected | ||
| 4.2.1 to ≤ 4.2.8 | affected | ||
FortiSandbox CloudBrowse Fortinet / FortiSandbox CloudDefault status: unaffected | CVE List | 5.0.4 | affected |
FortiSandbox PaaSBrowse Fortinet / FortiSandbox PaaSDefault status: unaffected | CVE List | 5.0.4 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-25691