An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions, FortiSandbox 2.2 all versions, FortiSandbox 2.1 all versions, FortiSandbox 2.0 all versions allows attacker to execute unauthorized code or commands via CLI.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-51652 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI. |
Fixes
Solution
Upgrade to FortiSandbox version 4.4.3 or above Upgrade to FortiSandbox version 4.2.7 or above Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://fortiguard.com/psirt/FG-IR-23-416 |
|
History
Wed, 14 Jan 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:fortinet:fortisandbox:4.2.0:*:*:*:*:*:*:* | |
| Metrics |
ssvc
|
Wed, 14 Jan 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI. | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions, FortiSandbox 2.2 all versions, FortiSandbox 2.1 all versions, FortiSandbox 2.0 all versions allows attacker to execute unauthorized code or commands via CLI. |
| CPEs | cpe:2.3:a:fortinet:fortisandbox:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.1.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.1.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.3.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.3.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.5.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.5.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:2.5.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* |
Mon, 23 Dec 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Fortinet
Fortinet fortisandbox |
|
| CPEs | cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Fortinet
Fortinet fortisandbox |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: fortinet
Published:
Updated: 2026-01-14T14:42:06.727Z
Reserved: 2023-11-06T10:35:25.828Z
Link: CVE-2023-47541
Vulnrichment
Updated: 2024-08-02T21:09:37.349Z
NVD
Status : Modified
Published: 2024-04-09T15:15:28.020
Modified: 2026-01-14T15:15:54.477
Link: CVE-2023-47541
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses