CVE-2025-54659
Description
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the fortisoar user on a system where the agent is deployed, via sending a crafted request to the agent port.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A path traversal in FortiSOAR Agent Communication Bridge allows unauthenticated attackers to read arbitrary files as the fortisoar user.
Vulnerability
Details An Improper Limitation of a Pathname to a Restricted Directory (CWE-22) vulnerability exists in FortiSOAR Agent Communication Bridge versions 1.0 and 1.1.0. The root cause is insufficient validation of user-supplied pathnames, enabling path traversal attacks.
Exploitation
An unauthenticated attacker can exploit this by sending a specially crafted request to the agent communication port. No authentication is required, and the attack complexity is low.
Impact
Successful exploitation allows the attacker to read any file that the fortisoar user has access to on the system where the agent is deployed. This could expose sensitive configuration files, credentials, or other confidential data.
Mitigation
Fortinet has released FortiSOAR Agent Communication Bridge 1.1.1 which fixes this vulnerability. Users on version 1.1.0 should upgrade, and those on 1.0 should migrate to a fixed release. Refer to the advisory [1] for details.
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3cpe:2.3:a:fortinet:fortisoar_agent_communication_bridge:1.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:fortinet:fortisoar_agent_communication_bridge:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortisoar_agent_communication_bridge:1.1:*:*:*:*:*:*:*
- (no CPE)range: <=1.1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- fortiguard.fortinet.com/psirt/FG-IR-26-084nvdVendor Advisory
News mentions
0No linked articles in our index yet.