Live › vulnerability › CVE-2026-39813
Go to dashboardFortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5 contain a path traversal flaw in how user-supplied paths are validated. A remote attacker without an account can read arbitrary files from the appliance filesystem.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
FortiSandbox appliances on the affected 4.4.x and 5.0.x branches are exposed, since the flaw is reachable without authentication over the network. Appliances on fixed versions, or not reachable from untrusted networks, are lower risk. Cloudflare WAF customers have a managed rule, but that is not a substitute for patching.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| fortinet fortisandbox | vendor | >= 4.4.0, < 4.4.9 | 4.4.9 |
| fortinet fortisandbox | vendor | >= 5.0.0, < 5.0.6 | 5.0.6 |
get system status on the CLI.4.4.9.5.0.6.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-07-01 · Changelog
New updates and improvements at Cloudflare.
July 1, 2026
This release adds targeted coverage for a path traversal flaw in Fortinet FortiSandbox (CVE-2026-39813) and transitions the Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule action from Block to Disabled.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...d84c92c9 | N/A | Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...c12cf9c8 | N/A | Anomaly:Header:User-Agent - Fake Bing or MSN Bot | Enabled | Disabled | We are changing the action for this rule from BLOCK to Disabled |
This page as .md · .json · in your agent: get_signal("CVE-2026-39813")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.