An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiSOAR PaaS and on‑premise deployments allows an authenticated remote attacker to leverage the File Content Extraction functionality to read files outside the intended directory, leading to disclosure of sensitive information. The flaw is a classic directory traversal (CWE‑22) and does not provide arbitrary code execution, but any local file can be accessed, potentially enabling further malicious activity.

Fortinet FortiSOAR PaaS and on‑premise deployments running any 7.3.x, 7.4.x, 7.5.x, or 7.6.x version up to 7.6.3 are impacted. The product line includes both cloud (PaaS) and on‑premises appliances.

The vulnerability carries a CVSS score of 6.2 (medium). The EPSS score is less than 1 %, indicating a very low but non‑zero probability of exploitation. The issue is not listed in the CISA KEV catalog. An attacker must be authenticated and have access to the File Content Extraction functionality. Once authenticated, traversal paths can be constructed to read arbitrary files on the host.