Arbitrary directory delete on vmimages delete feature

unknownCVE-2026-25691

CVSSv3 Score: 6.2 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS and FortiSandbox Cloud WEB UI may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests. Revised on 2026-04-14 00:00:00

CSIRTS triage

vendor: Fortinet product: FortiSandbox Path traversal

What: A path traversal vulnerability allows a privileged attacker to delete arbitrary directories via crafted HTTP requests.
Who is affected: Privileged users with super-admin profile and CLI access on FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS, and FortiSandbox Cloud WEB UI.
Urgency: This vulnerability has a moderate severity and should be addressed to prevent unauthorized directory deletions.
Action: Apply the latest patches for FortiSandbox and related products to fix this issue.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiSandbox

Get an email when a new FortiSandbox advisory drops — max one per day, one-click unsubscribe.

Details

Source: Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-04-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-115

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-256910.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-25691	coverage & exploitation status	NVD · CVE.org

Recent advisories for Arbitrary directory delete

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-74044: Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cl…nvd · 2026-08-18
highCVE-2026-19091: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for W…nvd · 2026-08-11
criticalCVE-2026-72569: A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenti…nvd · 2026-08-10
unknownCVE-2026-17556: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unau…nvd · 2026-08-05
highCVE-2026-14490: The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerabl…nvd · 2026-07-28