Fortinet FortiSIEM contains an improper limitation of a pathname to a restricted directory, allowing an attacker to navigate outside the intended directory using specially crafted packets. The flaw may enable execution of unauthorized code or commands, thereby compromising system confidentiality, integrity, and availability. The vulnerability is identified as CWE-22.

The vulnerability is specifically identified in Fortinet FortiSIEM version 7.5.0. The advisory lists this version as affected; no explicit mention of other 7.x releases is provided. Users should verify their installation version against the reported vulnerability and consider upgrading if they are running the impacted version.

The vulnerability has a CVSS score of 9.4, indicating a critical severity. No EPSS score is available, so the exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. An attacker with network access can potentially execute arbitrary code via specially crafted packets, as described by the vulnerability.