Fortinet FortiManager/FortiAnalyzer API Vulnerability Allows File Write and Delete
Fortinet has disclosed a path traversal vulnerability in FortiManager and FortiAnalyzer APIs, enabling authenticated read-only users to write and delete files on the underlying system.
Fortinet's Product Security Incident Response Team (PSIRT) has detailed a significant security flaw affecting its FortiManager and FortiAnalyzer platforms. The vulnerability, identified as an improper limitation of a pathname to a restricted directory (Path Traversal, CWE-22), allows an authenticated attacker with only read permissions to manipulate files on the system's underlying filesystem.
Exploitation of this vulnerability is possible through crafted HTTP or HTTPS requests targeting the API interfaces of the affected products. While the attacker must possess some level of authentication, the low privilege requirement of read-only access makes it a potentially accessible vector for internal threats or compromised accounts. The ability to write and delete arbitrary files can lead to a range of malicious activities, including the introduction of backdoors, modification of system configurations, or the deletion of critical data, severely impacting the integrity and availability of the targeted systems.
The vulnerability carries a CVSSv3 score of 7.3, classifying it as High severity. This score reflects the potential impact on confidentiality, integrity, and availability, as well as the ease with which it can be exploited. The CVSS vector indicates that while authentication is required, the attack complexity is relatively low, and the impact on integrity and confidentiality is significant.
Fortinet has provided a revised advisory on November 10, 2026, indicating that this information is current. While the advisory does not explicitly state whether patches are available or if the vulnerability has been exploited in the wild, users of FortiManager and FortiAnalyzer are strongly advised to review the Fortinet PSIRT advisory for the latest information on affected versions and remediation steps.
This path traversal vulnerability highlights a common class of security weaknesses where insufficient validation of user-supplied input, particularly file paths, can lead to unintended access to sensitive system resources. Such flaws are often found in API endpoints, which are increasingly targeted due to their role in system management and data exchange.
Organizations relying on FortiManager for centralized device management and FortiAnalyzer for security information and event management (SIEM) should prioritize assessing their exposure to this vulnerability. Implementing strict access controls and monitoring API traffic for suspicious activity can serve as crucial mitigation strategies while awaiting or applying official patches.