{"id":"CVE-2026-126219","kind":"vulnerability","aliases":["CVE-2026-126219"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: admin path traversal reads or writes files","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","summary":"A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets a logged-in administrator read or write arbitrary files and possibly run unauthorized code through crafted GUI requests. The sources list affected versions across the 7.4, 7.6 and 8.0 branches, including the cloud editions.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","network-security","self-hosted","vendor"],"not_affected_if":["gui-not-exposed","version-7.2","versions-outside-range"],"how_to_check":"Read the running version of FortiAnalyzer, FortiManager or their Cloud editions (GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0, 7.6.0-7.6.7, or 7.4.0-7.4.11 (Cloud 7.4 from 7.4.1). 7.2 is not affected. Then list administrator accounts and limit GUI access to trusted networks.","fix":"Upgrade FortiAnalyzer / FortiManager (and their Cloud editions) to 8.0.1 or above on 8.0, 7.6.8 or above on 7.6, 7.4.12 or above on 7.4. The 7.2 branch is not affected. No workaround is listed in the advisory.","status":"open","published_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:35+00:00","updated_at":"2026-11-11T22:42:00+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: admin path traversal reads or writes files","impact":"high","summary":"A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets a logged-in administrator read or write arbitrary files and possibly run unauthorized code through crafted GUI requests. The sources list affected versions across the 7.4, 7.6 and 8.0 branches, including the cloud editions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","network-security"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"administrator can read, write files or run commands on the appliance","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the NVD entry alone gives no fix.","how_to_check":"- Check the running version of FortiAnalyzer or FortiManager in the GUI or CLI and compare it with the affected ranges: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11.\n- Confirm whether the GUI is reachable from untrusted networks and which administrator accounts exist.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-range","gui-not-exposed"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or cloud) in the listed versions. The flaw needs an authenticated administrator, so exposure depends on who holds admin accounts and whether the GUI is reachable from less trusted networks.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4791,"output_tokens":626,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the NVD entry alone gives no fix.","search":"'-126219':14A,17A '-2026':13A,16A '7.4':70B '7.4.0':101C,124C '7.4.1':114C,137C '7.4.11':103C,116C,126C,139C '7.6':71B '7.6.0':97C,109C,120C,132C '7.6.7':99C,111C,122C,134C '8.0':73B '8.0.0':95C,106C,118C,129C 'across':68B 'admin':5A 'administr':48B,144C 'affect':66B 'allow':141C 'arbitrari':52B,149C 'authent':143C 'branch':74B 'cloud':21A,23A,77B,105C,108C,113C,128C,131C,136C 'code':58B,154C 'command':156C 'craft':60B,159C 'cve':12A,15A 'directori':88C 'edit':78B 'execut':152C 'file':11A,53B,150C 'flaw':37B 'fortianalyz':2A,24B,40B,94C,96C,100C,104C,107C,112C 'fortianalyzer':19A,22A 'fortimanag':4A,25B,42B,117C,119C,123C,127C,130C,135C 'fortimanager':18A,20A 'fortinet':1A,26B,39B,93C 'gui':61B,163C 'host':32B 'improp':80C 'includ':75B 'let':43B 'limit':81C 'list':65B 'log':46B 'logged-in':45B 'may':140C 'network':28B 'network-secur':27B 'path':6A,35B,89C 'pathnam':84C 'possibl':55B 'read':8A,49B,146C 'request':62B,160C 'restrict':87C 'run':56B 'secur':29B 'self':31B 'self-host':30B 'sourc':64B 'special':158C 'travers':7A,36B,90C 'unauthor':57B,153C 'vendor':33B 'version':67B 'via':157C 'vulner':91C 'write':10A,51B,148C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager (on-premises or Cloud) on 7.4, 7.6 or 8.0 below the fixed releases. An attacker needs a valid administrator login to the GUI, then uses crafted requests to read or write files or run unauthorized code or commands. Teams on 7.2 can skip it; it matters most where admin accounts are shared or the GUI is reachable from untrusted networks.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:42:00Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-236","run_id":3640},"products":{"at":"2026-11-11T22:42:00Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-236","run_id":3640},"how_to_check":{"at":"2026-11-11T22:42:00Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-236","run_id":3640},"who_affected":{"at":"2026-11-11T22:42:00Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-236","run_id":3640}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","networksecurity","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126219':14A,17A '-2026':13A,16A 'admin':5A 'cloud':21A,23A 'cve':12A,15A 'file':11A 'fortianalyz':2A 'fortianalyzer':19A,22A 'fortimanag':4A 'fortimanager':18A,20A 'fortinet':1A 'path':6A 'read':8A 'travers':7A 'write':10A","search_b":"'7.4':70B '7.6':71B '8.0':73B 'across':68B 'administr':48B 'affect':66B 'arbitrari':52B 'branch':74B 'cloud':77B 'code':58B 'craft':60B 'edit':78B 'file':53B 'flaw':37B 'fortianalyz':24B,40B 'fortimanag':25B,42B 'fortinet':26B,39B 'gui':61B 'host':32B 'includ':75B 'let':43B 'list':65B 'log':46B 'logged-in':45B 'network':28B 'network-secur':27B 'path':35B 'possibl':55B 'read':49B 'request':62B 'run':56B 'secur':29B 'self':31B 'self-host':30B 'sourc':64B 'travers':36B 'unauthor':57B 'vendor':33B 'version':67B 'write':51B","search_c":"'7.4.0':101C,124C '7.4.1':114C,137C '7.4.11':103C,116C,126C,139C '7.6.0':97C,109C,120C,132C '7.6.7':99C,111C,122C,134C '8.0.0':95C,106C,118C,129C 'administr':144C 'allow':141C 'arbitrari':149C 'authent':143C 'cloud':105C,108C,113C,128C,131C,136C 'code':154C 'command':156C 'craft':159C 'directori':88C 'execut':152C 'file':150C 'fortianalyz':94C,96C,100C,104C,107C,112C 'fortimanag':117C,119C,123C,127C,130C,135C 'fortinet':93C 'gui':163C 'improp':80C 'limit':81C 'may':140C 'path':89C 'pathnam':84C 'read':146C 'request':160C 'restrict':87C 'special':158C 'travers':90C 'unauthor':153C 'via':157C 'vulner':91C 'write':148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126219","severity":null,"published_at":"2026-11-11T22:17:19+00:00","modified_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126219:3640","url":"https://www.fortiguard.com/psirt/FG-IR-26-236","severity":null,"published_at":"2026-11-11T22:42:00+00:00","modified_at":"2026-11-11T22:42:00+00:00","first_seen_at":"2026-11-11T22:42:00+00:00","fetched_at":"2026-11-11T22:42:00+00:00","note":"Fortinet PSIRT FG-IR-26-236 (shared with CVE-2026-126220 and -126221) gives affected ranges and fixed versions; not exploited per vendor; no workaround or virtual patch listed. Admin-authenticated, CVSS 7.2. Found internally by Fortinet with an AI model.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-236"]}],"documents":[{"id":129691,"url":"https://www.fortiguard.com/psirt/FG-IR-26-236","title":"Fortinet PSIRT FG-IR-26-236: Improper limitation of a pathname to a restricted directory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}