{"id":"CVE-2026-126147","kind":"vulnerability","aliases":["CVE-2026-126147"],"related":[],"title":"FortiMail: path traversal lets unauthenticated attackers run unauthorized code","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.","summary":"Fortinet FortiMail mail gateway versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2 have a path traversal flaw. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","self-hosted","vendor"],"not_affected_if":["other-fortinet-products","unaffected-versions"],"how_to_check":"- Check the FortiMail firmware version in the admin GUI or with `get system status` on the CLI, and compare it against the affected ranges\n- Confirm whether the appliance is reachable from the internet on its web admin or mail-facing interfaces","fix":"- Upgrade to a fixed release: the sources do not name the fixed versions, so unknown","status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:31:01+00:00","updated_at":"2026-11-11T22:31:01+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:31:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a fixed release: the sources do not name the fixed versions, so unknown","reach":"internet","title":"FortiMail: path traversal lets unauthenticated attackers run unauthorized code","impact":"high","summary":"Fortinet FortiMail mail gateway versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2 have a path traversal flaw. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortinet","email-gateway","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs unauthorized code or commands on the appliance","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-126147 to confirm fixed versions and exploitation status; NVD alone gives only the affected ranges.","how_to_check":"- Check the FortiMail firmware version in the admin GUI or with `get system status` on the CLI, and compare it against the affected ranges\n- Confirm whether the appliance is reachable from the internet on its web admin or mail-facing interfaces","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-fortinet-products","unaffected-versions"],"who_is_affected":"FortiMail appliances and virtual machines in the listed version ranges are exposed, and the flaw needs no login. Teams running FortiMail 7.2, 7.4, 7.6, or 8.0.0 to 8.0.1 should treat it as urgent. Teams not running FortiMail in these ranges can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00079,"input_tokens":4599,"output_tokens":660,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126147':12A,15A '-2026':11A,14A '7.2':42B,89C '7.4.0':36B,85C '7.4.8':38B,87C '7.6.0':33B,81C '7.6.6':35B,83C '8.0.0':30B,77C '8.0.1':32B,79C 'allow':93C 'attack':6A,50B,96C 'code':9A,58B,100C 'command':60B,102C 'craft':53B,104C 'cve':10A,13A 'directori':70C 'email':17B 'email-gateway':16B 'execut':56B,98C 'flaw':47B 'fortimail':1A,19B,26B,76C,80C,84C,88C 'fortinet':20B,25B,75C 'gateway':18B,28B 'host':23B 'improp':62C 'let':4A 'limit':63C 'mail':27B 'may':92C 'path':2A,45B,71C 'pathnam':66C 'request':54B,105C 'restrict':69C 'run':7A 'self':22B 'self-host':21B 'send':52B 'travers':3A,46B,72C 'unauthent':5A,49B,95C 'unauthor':8A,57B,99C 'vendor':24B 'version':29B,91C 'via':103C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"FortiMail appliances and virtual machines in the listed version ranges are exposed, and the flaw needs no login. Teams running FortiMail 7.2, 7.4, 7.6, or 8.0.0 to 8.0.1 should treat it as urgent. Teams not running FortiMail in these ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","emailgateway","fortimail","fortinet","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126147':12A,15A '-2026':11A,14A 'attack':6A 'code':9A 'cve':10A,13A 'fortimail':1A 'let':4A 'path':2A 'run':7A 'travers':3A 'unauthent':5A 'unauthor':8A","search_b":"'7.2':42B '7.4.0':36B '7.4.8':38B '7.6.0':33B '7.6.6':35B '8.0.0':30B '8.0.1':32B 'attack':50B 'code':58B 'command':60B 'craft':53B 'email':17B 'email-gateway':16B 'execut':56B 'flaw':47B 'fortimail':19B,26B 'fortinet':20B,25B 'gateway':18B,28B 'host':23B 'mail':27B 'path':45B 'request':54B 'self':22B 'self-host':21B 'send':52B 'travers':46B 'unauthent':49B 'unauthor':57B 'vendor':24B 'version':29B","search_c":"'7.2':89C '7.4.0':85C '7.4.8':87C '7.6.0':81C '7.6.6':83C '8.0.0':77C '8.0.1':79C 'allow':93C 'attack':96C 'code':100C 'command':102C 'craft':104C 'directori':70C 'execut':98C 'fortimail':76C,80C,84C,88C 'fortinet':75C 'improp':62C 'limit':63C 'may':92C 'path':71C 'pathnam':66C 'request':105C 'restrict':69C 'travers':72C 'unauthent':95C 'unauthor':99C 'version':91C 'via':103C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126147","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}