Path Traversal in Fortinet Fortimail

CVE-2026-126147

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2026-11-11 · last modified 2026-11-12.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Fortinet Fortimail

Weakness classification (CWE)

CWE-22 — Path Traversal

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

googlesky/CVE-2026-126147 (last pushed 2026-11-12): Containerised PoC for CVE-2026-126147 (Fortinet FG-IR-26-199): a path traversal (CWE-22) in the FortiMail management interface API lets an unauthenticated request write outside the restricted directo…

References

fortiguard.fortinet.com/psirt/FG-IR-26-199

This CVE has public exploit evidence. See the latest CVEs with public exploits.