gcdRadar
live/Patch now/AIR-2026-1872
livelivePatch now2 Disclosed vulnerability

FortiMail path traversal enables unauthorized code execution

FortiMail

An improper limitation of a pathname (CWE‑22) in FortiMail allows an unauthenticated attacker to traverse directories and execute unauthorized code via crafted requests. The issue is rated CVSS v3 9.8, marking it as a critical vulnerability.

why this severityCritical CVSS 9.8 disclosed vulnerability, no confirmed exploitation

CVSS
9.8
fix status
Fix status unknown
first report
10 Nov 2026
last update
10 Nov 2026

Timeline · 1

  1. 10 Nov 2026Improper limitation of a pathname to a restricted directory

Sources · 1

Advisories and databases

  1. 2026-11-10
    Improper limitation of a pathname to a restricted directory
    Fortinet · fortiguard.fortinet.com/psirt/FG-IR-26-199

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
No AI role
categories
General security
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Not applicable
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
tags
path-traversalcvefortimailfortiguard
dates
happened 10 Nov 2026 · first reported 10 Nov 2026
origin
News & research feeds
record
confidence 0.95 · created 2026-11-10 20:42Z · updated 2026-11-10 20:42Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# FortiMail path traversal enables unauthorized code execution

https://gcdradar.vercel.app/incidents/fortimail-path-traversal-enables-unauthorized-code-execution · AIR-2026-1872 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical CVSS 9.8 disclosed vulnerability, no confirmed exploitation
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiMail
- CVSS: 9.8

## Summary

An improper limitation of a pathname (CWE‑22) in FortiMail allows an unauthenticated attacker to traverse directories and execute unauthorized code via crafted requests. The issue is rated CVSS v3 9.8, marking it as a critical vulnerability.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-10: Improper limitation of a pathname to a restricted directory (https://fortiguard.fortinet.com/psirt/FG-IR-26-199)

## Sources

- 2026-11-10 Fortinet: Improper limitation of a pathname to a restricted directory https://fortiguard.fortinet.com/psirt/FG-IR-26-199

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. live9.8
    FortiMail FortiMail command injection allows unauthenticated code execution

    Patch now · Disclosed · since 10 Nov 2026

  2. live9.1
    FortiMail Fortinet FortiMail Incorrect Authorization Vulnerability

    Patch now · Disclosed · since 10 Nov 2026

  3. closed
    FortiOS Fortinet patches critical FortiOS flaws found with AI help

    Patch now · Disclosed · Patched · since 26 Oct 2026

  4. live
    Dixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units

    Patch now · Exploited · since 13 Nov 2026

  5. live8.6
    UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability

    Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713

  6. live
    City of Osaka municipal systems City of Osaka suffers data breach impacting one million residents

    Breaches & attacks · Real loss · since 13 Nov 2026