---
id: "CVE-2026-126235"
page: "https://infrastack.ai/live/CVE-2026-126235"
kind: "vulnerability"
aliases: ["CVE-2026-126235"]
title: "Fortinet FortiAnalyzer and FortiManager: path traversal lets admins write arbitrary files"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "fixed-version", "no-admin-access-exposed", "unaffected-version"]
published_at: "2026-11-11T22:17:22+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:38:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126235", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-250", "first_seen_at": "2026-11-11T22:38:35+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-250"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: path traversal lets admins write arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-126235 (this .md is for agents)

A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated administrator write files outside the intended directory using a specially crafted archive. The sources describe arbitrary file writes, which can lead to code execution on the appliance, but do not state that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected 8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager affected 8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13

## How to check

Check the firmware version (GUI dashboard System Information, or CLI 'get system status'). Affected: FortiAnalyzer and FortiManager 8.0.0-8.0.1, 7.6.2-7.6.7, 7.4.7-7.4.11, 7.2.10-7.2.12; Cloud editions 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12. Also review who holds administrator accounts.

## Fix

Upgrade to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 (or above) for FortiAnalyzer, FortiManager and their Cloud editions; no virtual patch or workaround listed.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126235
- 2026-11-11T22:38:35+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-250 — Read Fortinet PSIRT FG-IR-26-250: fixed versions, affected ranges, not exploited. Impact listed as unauthorized code/commands.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-250 https://fortiguard.fortinet.com/psirt/FG-IR-26-250

## From the sources

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_