CVE-2026-25691

MediumCVSS 6.7/10Last modified Oct 26, 2026

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Fortinet	FortiSandbox PaaS	5.0.4
Fortinet	FortiSandbox Cloud	5.0.4
Fortinet	FortiSandbox	>= 5.0.0, <= 5.0.5; >= 4.4.0, <= 4.4.8; >= 4.2.1, <= 4.2.8

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-115Vendor Advisory

Timeline

Published: Apr 14, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256996.1Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through CVE-2026-257007.2Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previou CVE-2026-257017.0An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like CVE-2026-257029.8A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules ap CVE-2026-257037.3NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data co CVE-2026-257045.8A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in cosmic-greeter can allow an attac CVE-2026-257058.4A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extens CVE-2026-257067.5Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Ac CVE-2026-257078.8A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers suppl CVE-2026-25714.3The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserS CVE-2026-257107.0The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasma CVE-2026-257117.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the