A directory traversal flaw, identified as CWE-24, exists in Fortinet FortiSandbox versions 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. When an attacker sends a crafted HTTP request containing the sequence '../filedir', the sandbox may resolve paths outside the intended sandbox directory, allowing the attacker to access files or execute code with the privileges of the sandbox host. As a result, the attacker can elevate their privileges on the FortiSandbox system without authentication. This flaw directly violates the principle of least privilege and enables unauthorized modification of system files or execution of arbitrary code.

FortiSandbox on-premises installations feature versions 4.4.0 to 4.4.8 and 5.0.0 to 5.0.5, while the FortiSandbox Cloud service offers versions 23.4, 24.1, 5.0.4, and 5.0.5. All affected instances expose an HTTP interface that can be remotely accessed by network users, making them susceptible to this traversal attack regardless of location.

The base CVSS score of 9.1 classifies the vulnerability as critical. An EPSS score of 23% indicates a moderate probability that attackers will target and exploit this flaw, even though it does not appear in the CISA KEV catalog. The attack vector is network‑based, requiring the ability to send HTTP requests to the FortiSandbox service. If an attacker succeeds, they can gain elevated privileges on the host machine, potentially compromising the entire infrastructure.