A relative path traversal flaw in Fortinet FortiWeb firmware versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.1 through 7.4.13, 7.2.7 through 7.2.13, and 7.0.10 through 7.0.12 permits a local privileged attacker to execute unauthorized commands on the underlying system via crafted CLI commands. This vulnerability is classified as CWE‑23, enabling manipulation of file path inputs to bypass directory boundaries.

The affected product is Fortinet FortiWeb. Systems running any of the listed firmware ranges are impacted; this includes the 8.x, 7.6.x, 7.4.x, 7.2.x, and 7.0.x branches.

The CVSS score of 6.2 indicates moderate impact. EPSS less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the KEV catalog, so no known widespread exploitation has been reported. Based on the description, a local privileged attacker could craft specific CLI commands that include relative path sequences, allowing execution of arbitrary code on the underlying system. This attack vector is inferred from the mention of crafted CLI commands rather than an explicit network-based vector.