CVE-2026-39814

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12, FortiWeb 7.0.10 through 7.0.12 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-398158.8A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7 CVE-2026-398168.8The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Ap CVE-2026-398175.9The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filena CVE-2026-398195.3The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with ac CVE-2026-39824.3A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2026-398207.5Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocati CVE-2026-398219.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("x CVE-2026-398227.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of CVE-2026-398236.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL conte CVE-2026-398243.3NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStri CVE-2026-398255.3ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director fu CVE-2026-398266.1If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespac