Paper/Archive/CVE-2026-126147

CVE-2026-126147

Fortinet FortiMail — A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1,…

CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0 – 8.0.1–CNA

FortiMail7.6.0 – 7.6.6–CNA

FortiMail7.4.0 – 7.4.8–CNA

FortiMail7.2.0 – 7.2.9–CNA

Scores by source

fortinet (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R

References

reffortiguard.fortinet.com/psirt/FG-IR-26-199