An improperly limited pathname check in Fortinet FortiSOAR allows an authenticated remote attacker to use the File Content Extraction feature to read files outside of the intended directory, enabling disclosure of sensitive information. The flaw is a classic directory traversal (CWE‑22). No arbitrary code execution is described, but the ability to read arbitrary local files can lead to data leakage or serve as a foundation for more advanced attacks.

Fortinet FortiSOAR PaaS and on‑premise deployments running any 7.3.x, 7.4.x, 7.5.x, or 7.6.x version up to 7.6.3 are impacted. The product line includes both cloud (PaaS) and on‑premises appliances.

The vulnerability carries a CVSS score of 6.2 (medium). Exploit probability is not quantified by EPSS, and the issue is not currently listed in the CISA KEV catalog. The attack requires an authenticated session; an attacker must be able to log in to the FortiSOAR system and has access to the File Content Extraction functionality. Once the conditions are met, traversal paths can be constructed to read arbitrary files on the host.