Path Traversal in CLI
CVSSv3 Score: 5.4 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. Revised on 2026-04-14 00:00:00
CSIRTS triage
- What
- Privileged attackers may delete files from the filesystem via crafted CLI requests.
- Who is affected
- Privileged users of the specified Fortinet products.
- Urgency
- Remediation is important to prevent unauthorized file deletion.
- Action
- Review and restrict CLI access permissions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud
Get an email when a new FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-120
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-686490.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-68649 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Path Traversal in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-42219: Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversa…nvd · 2026-07-10
- unknownCVE-2026-41482: Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal an…nvd · 2026-07-10
- highCVE-2026-58499: EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal …nvd · 2026-07-10
- mediumCVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with …nvd · 2026-07-10
- highGHSA-p4m3-mgmm-c664: SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary f…ghsa · 2026-07-10
- highCVE-2025-70796: An unauthenticated path traversal vulnerability exists in the web management interface of WTI …nvd · 2026-07-10
More from Fortinet FortiGuard PSIRT
- unknownSecond-Order OS Command Injection via JSON Input on start vnc feature2026-06-09
- unknownImproper access control in API endpoints2026-06-09
- unknownRestricted CLI escape using Lua2026-06-09
- unknownLinux Kernel vulnerability Dirty Frag2026-06-03
- unknownLinux Kernel Vulnerability copy.fail - CVE-2026-314312026-05-13