---
id: "CVE-2026-126147"
page: "https://infrastack.ai/live/CVE-2026-126147"
kind: "vulnerability"
aliases: ["CVE-2026-126147"]
title: "FortiMail: path traversal lets unauthenticated attackers run unauthorized code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["email-gateway", "fortimail", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["other-fortinet-products", "unaffected-versions"]
published_at: "2026-11-11T22:17:11+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126147", "first_seen_at": "2026-11-11T22:29:27+00:00"}]
exploit_sources: []
---

# FortiMail: path traversal lets unauthenticated attackers run unauthorized code

Link for people: https://infrastack.ai/live/CVE-2026-126147 (this .md is for agents)

Fortinet FortiMail mail gateway versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2 have a path traversal flaw. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FortiMail firmware version in the admin GUI or with `get system status` on the CLI, and compare it against the affected ranges
- Confirm whether the appliance is reachable from the internet on its web admin or mail-facing interfaces

## Fix

- Upgrade to a fixed release: the sources do not name the fixed versions, so unknown

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126147

## From the sources

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_