A relative path traversal flaw exists in Fortinet FortiWeb firmware versions ranging from 8.0.0 to 8.0.2, 7.6.0 to 7.6.6, 7.4.1 to 7.4.12, 7.2.7 to 7.2.12, and 7.0.10 to 7.0.12. The flaw allows an attacker to manipulate path inputs to bypass directory boundaries, potentially enabling the execution of arbitrary code or commands on the host. The vulnerability is classified as CWE‑23.

The affected product is Fortinet FortiWeb. Systems running any of the listed firmware ranges are impacted; this includes the 8.x, 7.6.x, 7.4.x, 7.2.x, and 7.0.x branches.

The CVSS score of 6.2 indicates a moderate risk. EPSS data is unavailable, so the likelihood of exploitation is unclear from the data. The vulnerability is not in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet. Based on the nature of the flaw, the likely attack vector is a crafted HTTP request that includes relative path sequences to reach privileged files, but this is inferred rather than explicitly stated.