This vulnerability is a path traversal flaw (CWE‑22) that allows an authenticated user with administrative CLI access to write or delete arbitrary files outside the intended protected directory. The attacker could replace critical configuration files, scripts, or firmware with malicious content, thereby compromising the integrity and potentially the availability of the device.

The flaw affects Fortinet FortiOS versions 6.4 through 7.6.4, FortiPAM 1.0 through 1.7, FortiProxy 7.0 through 7.6.4, and FortiSwitchManager 7.0.0 through 7.2.7. All listed operating systems and firmware packages are subject to the path traversal issue; the advisory lists each product name and respective affected release ranges.

The CVSS base score of 5.4 indicates moderate severity. Exploitation requires valid administrative credentials and read‑write CLI permissions; therefore, the attack vector is likely internal or via an authenticated network session rather than unauthenticated remote access. No public exploit has been disclosed, and the vulnerability is not in the CISA KEV catalog, which suggests the risk of immediate exposure is limited to environments where privileged users can be compromised.