A path '../' exists in Fortinet FortiSandbox. When an attacker supplies a specially crafted HTTP request containing these traversal characters, the sandbox may allow the traversal of protected directories, resulting in unauthorized escalation of privileges on the FortiSandbox host. The flaw aligns with CWE-24, reflecting a design weakness that permits directory traversal attacks.

Fortinet FortiSandbox and FortiSandbox Cloud are affected. Vulnerable versions are 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. The issue spans both on‑premises installations and the cloud offering.

The CVSS base score of 9.1 indicates this flaw is critical. An EPSS score of 17% suggests the likelihood of exploitation is low, even though the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a network‑reachable HTTP interface where an attacker submits a crafted request that exploits the directory traversal flaw to gain elevated privileges on the FortiSandbox host.