{"id":"CVE-2026-126235","kind":"vulnerability","aliases":["CVE-2026-126235"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: path traversal lets admins write arbitrary files","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive.","summary":"A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated administrator write files outside the intended directory using a specially crafted archive. The sources describe arbitrary file writes, which can lead to code execution on the appliance, but do not state that.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["auth-required","fixed-version","no-admin-access-exposed","unaffected-version"],"how_to_check":"Check the firmware version (GUI dashboard System Information, or CLI 'get system status'). Affected: FortiAnalyzer and FortiManager 8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12; Cloud editions 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12. Also review who holds administrator accounts.","fix":"Upgrade to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 (or above) for FortiAnalyzer, FortiManager and their Cloud editions; no virtual patch or workaround listed.","status":"open","published_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:20+00:00","updated_at":"2026-11-11T22:38:35+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: path traversal lets admins write arbitrary files","impact":"high","summary":"A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated administrator write files outside the intended directory using a specially crafted archive. The sources describe arbitrary file writes, which can lead to code execution on the appliance, but do not state that.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker writes arbitrary files on the management appliance","analyst_note":"Fixed versions and vendor advisory not in sources; check Fortinet PSIRT for this CVE's fix and whether arbitrary write leads to code execution.","how_to_check":"- Check the installed version under the product's System Information page against the affected ranges in the description: FortiAnalyzer `8.0.0` to `8.0.1`, `7.6.2` to `7.6.7`, `7.4.7` to `7.4.11`, `7.2.10` to `7.2.12`; FortiManager and Cloud variants in the same ranges.\n- Review who holds administrator accounts on these appliances.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-admin-access-exposed"],"who_is_affected":"Organizations running FortiAnalyzer, FortiManager, or their Cloud editions within the listed version ranges. Exposure requires an authenticated administrator account, so limiting admin accounts reduces risk. Systems on versions outside these ranges are not listed as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000826,"input_tokens":4901,"output_tokens":671,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and vendor advisory not in sources; check Fortinet PSIRT for this CVE's fix and whether arbitrary write leads to code execution.","search":"'-126235':14A,17A '-2026':13A,16A '7.2.1':125C,161C '7.2.10':105C,141C '7.2.12':107C,127C,143C,163C '7.4.1':120C,156C '7.4.11':103C,122C,139C,158C '7.4.7':101C,137C '7.6.0':115C,151C '7.6.2':97C,133C '7.6.7':99C,117C,135C,153C '8.0.0':93C,110C,129C,146C '8.0.1':95C,112C,131C,148C 'admin':8A 'administr':46B,168C 'allow':165C 'applianc':72B 'arbitrari':10A,61B,171C 'archiv':57B,177C 'auth':25B 'auth-requir':24B 'authent':45B,167C 'cloud':21A,23A,109C,114C,119C,124C,145C,150C,155C,160C 'code':68B 'craft':56B,176C 'cve':12A,15A 'describ':60B 'directori':52B,86C 'execut':69B 'file':11A,48B,62B,172C 'flaw':37B 'fortianalyz':2A,27B,40B,92C,96C,100C,104C,108C,113C,118C,123C 'fortianalyzer':18A,20A 'fortimanag':4A,28B,42B,128C,132C,136C,140C,144C,149C,154C,159C 'fortimanager':19A,22A 'fortinet':1A,29B,39B,91C 'host':32B 'improp':78C 'intend':51B 'lead':66B 'let':7A,43B 'limit':79C 'may':164C 'outsid':49B 'path':5A,35B,87C 'pathnam':82C 'requir':26B 'restrict':85C 'self':31B 'self-host':30B 'sourc':59B 'special':55B,175C 'state':76B 'travers':6A,36B,88C 'use':53B 'vendor':33B 'via':173C 'vulner':89C 'write':9A,47B,63B,170C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed FortiAnalyzer or FortiManager (or the Cloud editions) in the listed version ranges. The attacker needs an authenticated administrator account and uploads a specially crafted archive to write arbitrary files; Fortinet lists the impact as unauthorized code or command execution. Versions at or above the fixed releases, or setups with no untrusted admin access, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:38:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250","run_id":3628},"how_to_check":{"at":"2026-11-11T22:38:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250","run_id":3628},"who_affected":{"at":"2026-11-11T22:38:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250","run_id":3628}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["authrequired","fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126235':14A,17A '-2026':13A,16A 'admin':8A 'arbitrari':10A 'cloud':21A,23A 'cve':12A,15A 'file':11A 'fortianalyz':2A 'fortianalyzer':18A,20A 'fortimanag':4A 'fortimanager':19A,22A 'fortinet':1A 'let':7A 'path':5A 'travers':6A 'write':9A","search_b":"'administr':46B 'applianc':72B 'arbitrari':61B 'archiv':57B 'auth':25B 'auth-requir':24B 'authent':45B 'code':68B 'craft':56B 'describ':60B 'directori':52B 'execut':69B 'file':48B,62B 'flaw':37B 'fortianalyz':27B,40B 'fortimanag':28B,42B 'fortinet':29B,39B 'host':32B 'intend':51B 'lead':66B 'let':43B 'outsid':49B 'path':35B 'requir':26B 'self':31B 'self-host':30B 'sourc':59B 'special':55B 'state':76B 'travers':36B 'use':53B 'vendor':33B 'write':47B,63B","search_c":"'7.2.1':125C,161C '7.2.10':105C,141C '7.2.12':107C,127C,143C,163C '7.4.1':120C,156C '7.4.11':103C,122C,139C,158C '7.4.7':101C,137C '7.6.0':115C,151C '7.6.2':97C,133C '7.6.7':99C,117C,135C,153C '8.0.0':93C,110C,129C,146C '8.0.1':95C,112C,131C,148C 'administr':168C 'allow':165C 'arbitrari':171C 'archiv':177C 'authent':167C 'cloud':109C,114C,119C,124C,145C,150C,155C,160C 'craft':176C 'directori':86C 'file':172C 'fortianalyz':92C,96C,100C,104C,108C,113C,118C,123C 'fortimanag':128C,132C,136C,140C,144C,149C,154C,159C 'fortinet':91C 'improp':78C 'limit':79C 'may':164C 'path':87C 'pathnam':82C 'restrict':85C 'special':175C 'travers':88C 'via':173C 'vulner':89C 'write':170C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126235","severity":null,"published_at":"2026-11-11T22:17:22+00:00","modified_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126235:3628","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250","severity":null,"published_at":"2026-11-11T22:38:35+00:00","modified_at":"2026-11-11T22:38:35+00:00","first_seen_at":"2026-11-11T22:38:35+00:00","fetched_at":"2026-11-11T22:38:35+00:00","note":"Read Fortinet PSIRT FG-IR-26-250: fixed versions, affected ranges, not exploited. Impact listed as unauthorized code/commands.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-250"]}],"documents":[{"id":129675,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250","title":"Fortinet PSIRT FG-IR-26-250","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}