Fortinet FortiSandbox 5.x suffers from an improper neutralization of input during web page generation, allowing an attacker to inject malicious JavaScript when a victim accesses a crafted URL. The injected code runs in the victim’s browser context and can steal session cookies, manipulate page content, or redirect to phishing sites. The flaw is a classic Cross‑Site Scripting weakness.

Affected products are Fortinet FortiSandbox and FortiSandbox PaaS, versions 5.0.0 through 5.0.4. Any user deploying these releases is vulnerable unless a patch or upgrade has been applied.

The CVSS score of 4.9 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. An attacker can remotely craft a malicious HTTP request that targets the FortiSandbox web interface; the injected payload is displayed when a user views the resulting page, thus triggering the XSS. Although EPSS data is unavailable, the potential impact remains significant for exposed services.