Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb…
Impact
Fortinet FortiWeb versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.1 through 7.4.13, 7.2.7 through 7.2.13, and 7.0.10 through 7.0.12 have a Relative Path Traversal vulnerability that may allow a local privileged attacker to execute unauthorized code. The weakness is described as CWE-23.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to FortiWeb version 8.0.3 or above Upgrade to FortiWeb version 7.6.7 or above
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Fortinet · fortinet
FortiWeb
5 ranges
Fortinet · fortinet
FortiWeb
Compare with this publisher’s ranges. This does not inspect your installation.
affected
8.0.0 → through 8.0.2
semver versions
7.6.0 → through 7.6.6
semver versions
7.4.1 → through 7.4.13
semver versions
7.2.7 → through 7.2.13
semver versions
7.0.10 → through 7.0.12
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.13:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.12:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.13:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.12:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.0.12:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*Original source description
Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.13, FortiWeb 7.2.7 through 7.2.13, FortiWeb 7.0.10 through 7.0.12 may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-39814View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.