Description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Published: 2026-10-01
Score: 9.8 Critical
EPSS: 2.2% Low
KEV: Yes
Impact: Arbitrary file write capable of system compromise
Action: Immediate Patch
AI Analysis

Impact

An improper restriction of a pathname allows an unauthenticated attacker to write arbitrary files to the underlying operating system by sending crafted HTTP or HTTPS requests. The flaw can result in the placement of malicious files, compromising the confidentiality, integrity, and availability of the affected system.

Affected Systems

FortiMail versions 8.0.0 and 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9 are impacted.

Risk and Exploitability

Authentication is not required; the attack uses standard HTTP or HTTPS traffic. The high CVSS score of 9.8 reflects the severe potential impact. The EPSS score of approximately 1.78% indicates a low but nonzero probability of exploitation, yet the vulnerability is catalogued in CISA KEV, underscoring the urgency for remediation.

Generated by OpenCVE AI on October 2, 2026 at 15:54 UTC.

Remediation

Vendor Solution

Upgrade to upcoming FortiMail version 8.0.1 or above Upgrade to upcoming FortiMail version 7.6.6 or above Upgrade to upcoming FortiMail version 7.4.8 or above Upgrade to upcoming FortiMail version 7.2.10 or above Upgrade to FortiRecorder version 7.6.1 or above Upgrade to FortiRecorder version 7.2.12 or above Upgrade to upcoming FortiRecorder version 7.0.7 or above Fortinet remediated this issue in FortiMail Cloud version 25.1 (not released) and hence customers do not need to perform any action.

OpenCVE Recommended Actions

  • Upgrade FortiMail to 8.0.1 or any later version that is not listed as vulnerable, or to 7.6.6, 7.4.8, or 7.2.10 as applicable.
  • If FortiRecorder is in use, upgrade it to at least version 7.6.1, 7.2.12, or 7.0.7.
  • Restrict or monitor incoming HTTP/HTTPS traffic to the FortiMail appliance until the patches are applied.

Generated by OpenCVE AI on October 2, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Improper Pathname Restriction Allows Unauthenticated Arbitrary File Write in Fortinet FortiMail

Fri, 02 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*

Thu, 01 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Improper Pathname Restriction Allows Unauthenticated Arbitrary File Write in Fortinet FortiMail

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-01T00:00:00+00:00', 'dueDate': '2026-10-04T00:00:00+00:00'}

Thu, 01 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
First Time appeared Fortinet
Fortinet fortimail
Weaknesses CWE-22
CPEs cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortimail
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

Subscriptions

Fortinet Fortimail
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-10-07T17:59:34.842Z

Reserved: 2026-10-01T19:12:54.081Z

Link: CVE-2026-104286

cve-icon Vulnrichment

Updated: 2026-10-01T19:38:33.218Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T20:17:24.010

Modified: 2026-10-07T18:17:15.240

Link: CVE-2026-104286

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T16:00:13Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')