Arbitrary directory delete on vmimages delete feature

CSIRTS triage

What

A path traversal vulnerability allows a privileged attacker to delete arbitrary directories via crafted HTTP requests.

Who is affected

Privileged users with super-admin profile and CLI access on FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS, and FortiSandbox Cloud WEB UI.

Urgency

This vulnerability has a moderate severity and should be addressed to prevent unauthorized directory deletions.

Action

Apply the latest patches for FortiSandbox and related products to fix this issue.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)

Severity

unknown

Published

2026-04-14

Exploitation

Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-115

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-256910.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.

Referenced CVEs

More from Fortinet FortiGuard PSIRT

• unknownSecond-Order OS Command Injection via JSON Input on start vnc feature2026-06-09
• unknownImproper access control in API endpoints2026-06-09
• unknownRestricted CLI escape using Lua2026-06-09
• unknownLinux Kernel vulnerability Dirty Frag2026-06-03
• unknownLinux Kernel Vulnerability copy.fail - CVE-2026-314312026-05-13