CVE-2026-126153 · Vendor
NO FIX YET
A path traversal flaw in Fortinet FortiMail lets an attacker escape a restricted directory using crafted requests. According to the description, an unauthenticated attacker may be able to execute unauthorized commands.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running FortiMail in the affected version ranges, which are reachable by an attacker. The sources do not say which deployment settings are required, so exposure cannot be confirmed from them. Teams not running FortiMail can skip it.
Not affected if unaffected-version
Who cares email-gateway, fortimail, fortinet
8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.No fix yet, per the sources.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.