A command injection vulnerability exists in Fortinet FortiSandbox due to improper neutralization of special elements used in commands. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests, potentially compromising the entire sandbox environment. The vulnerability, identified as CWE‑77, could lead to loss of confidentiality, integrity, and availability.

The affected products are Fortinet FortiSandbox versions 5.2.0, 5.0.0 through 5.0.6, and 4.4.0 through 4.4.9. Any deployment using these legacy releases is susceptible unless upgraded to a supported version. The vendor provides separate patch release paths for the 5.x and 4.x branches, with the newest corrective releases being 5.2.1, 5.0.7, and 4.4.10 respectively.

The CVSS base score of 6.7 reflects moderate severity; the EPSS score of 1% indicates a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. While the advisory does not detail the exact attack vector, it indicates that an attacker with privileged access can execute arbitrary commands through crafted HTTP requests. If exploited, the attacker could gain control of the FortiSandbox host.