Fortinet · FortiOS
CVE-2018-13379
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
What it is
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
CISA: Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
| Jun 25, 2025 | Use of Hard-Coded Credentials | FortiOS | Medium 6.5 | 6.6% |
| Feb 9, 2024 | Out-of-Bound Write | FortiOS | Critical 9.6 | 85% |
| Mar 14, 2023 | Path Traversal | FortiOS | Medium 6.5 | 11% |
| Dec 13, 2022 | Heap-Based Buffer Overflow | FortiOS | Critical 9.3 | 99.5% |
| Dec 10, 2021 | Arbitrary File Download | FortiOS | Low 3.3 | 0.9% |
| Nov 3, 2021 | Default Configuration | FortiOS | Medium 6.5 | 19% |
| Nov 3, 2021 | SSL VPN Improper Authentication | FortiOS | High 7.5 | 45% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.