PT-2026-32678 · Fortinet · Fortisandbox Cloud+2

Published 2026-04-14 · Updated 2026-04-19 · CVE-2026-25691

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.0.0 through 5.0.5 FortiSandbox versions 4.4.0 through 4.4.8 FortiSandbox version 4.2 FortiSandbox Cloud version 5.0.4 FortiSandbox PaaS version 5.0.4

Description An improper limitation of a pathname to a restricted directory, known as path traversal, exists in the system. This issue may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory by sending crafted HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-05446

CVE-2026-25691

Affected Products

Fortisandbox

Fortisandbox Cloud

Fortisandbox Paas

References · 4

• https://fortiguard.fortinet.com/psirt/FG-IR-26-115 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05446 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25691 · Security Note
• https://twitter.com/CVEnew/status/2045889773307396446 · Twitter Post