An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and all 7.0 releases enables an unauthenticated attacker to write arbitrary files on the underlying operating system via crafted HTTP or HTTPS requests. This flaw allows placement of malicious files, potentially leading to disclosure, modification, or execution of code that compromises the confidentiality, integrity, and availability of the affected system.

FortiMail versions 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7, 7.2.0 through 7.2.9, and all 7.0 releases are impacted.

Authentication is not required; the attack uses standard HTTP or HTTPS traffic. The high CVSS score of 9.8 reflects the severe potential impact. The EPSS score of 5% indicates a moderate probability of exploitation, yet the vulnerability is catalogued in CISA KEV, underscoring the urgency for remediation.