Fortinet · FortiOS
CVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability
What it is
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
CISA: Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 4, 2023
- Added to the CISA list
- March 14, 2023
- Published
- March 7, 2023
- Severity
- Medium 6.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 11% in the top 4.2% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
| Jun 25, 2025 | Use of Hard-Coded Credentials | FortiOS | Medium 6.5 | 6.6% |
| Feb 9, 2024 | Out-of-Bound Write | FortiOS | Critical 9.6 | 85% |
| Dec 13, 2022 | Heap-Based Buffer Overflow | FortiOS | Critical 9.3 | 99.5% |
| Dec 10, 2021 | Arbitrary File Download | FortiOS | Low 3.3 | 0.9% |
| Nov 3, 2021 | Default Configuration | FortiOS | Medium 6.5 | 19% |
| Nov 3, 2021 | SSL VPN Path Traversal | FortiOS | Critical 9.1 | >99.9% |
| Nov 3, 2021 | SSL VPN Improper Authentication | FortiOS | High 7.5 | 45% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.