{"id":"CVE-2026-39813","published":"2026-04-14T15:38:30Z","modified":"2026-06-18T09:01:15Z","title":"A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…","vendor":"Fortinet","product":"FortiSandbox","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSandbox","versions":[">= 5.0.0, <= 5.0.5",">= 4.4.0, <= 4.4.8"]},{"vendor":"Fortinet","product":"FortiSandbox Cloud","versions":["24.1","23.4",">= 5.0.4, <= 5.0.5"]}],"description":{"text":"A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"A path traversal flaw in the '../filedir' handling of Fortinet FortiSandbox, affecting versions 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8, lets an attacker traverse outside the intended directory. An attacker with network access can exploit it without authentication or user interaction by sending specially crafted HTTP requests to gain escalated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:12Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.22224,"percentile":0.97675,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-15","exploitedFirstSeen":"2026-06-15","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-39813","date":"2026-06-15"},{"url":"https://x.com/DefusedCyber/status/2066575288503255274","date":"2026-06-15"},{"url":"https://www.techgines.com/post/fortibleed-fortigate-credential-compromise-86000-firewalls","date":"2026-06-21"},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","date":"2026-07-10"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"EbeeJuly2026 Pt1","url":"https://otx.alienvault.com/pulse/6a4b3cc2ebf14a6ed2559ae1","created":"2026-07-06"},{"name":"Fortinet FortiBleed Global Compromise & Active Exploitation of Fortinet Vulnerabilities.","url":"https://otx.alienvault.com/pulse/6a453afe4aa12955b2b60fe5","created":"2026-07-01"},{"name":"Known_Cve | Apr 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69ea3f5ba5d3a028c6ef7ecf","created":"2026-04-23"},{"name":"Known_Cve | Apr 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e8ec53d8e9285aa573199c","created":"2026-04-22"},{"name":"Known_Cve | Apr 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e79c01c3d8244296d32902","created":"2026-04-21"},{"name":"Known_Cve | Apr 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e64ae4502f00a0cc9986e5","created":"2026-04-20"},{"name":"Known_Cve | Apr 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e4f971582b6761602eb4a2","created":"2026-04-19"},{"name":"Known_Cve | Apr 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e3a7638300f0eb1346a035","created":"2026-04-18"},{"name":"Known_Cve | Apr 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e25442402a04b23b8aa1a2","created":"2026-04-17"},{"name":"Known_Cve | Apr 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e103976603776b725a4a5a","created":"2026-04-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-24","name":"Path Traversal: '../filedir'"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-112","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-22344","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22344","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-04-23","earliestUrl":"https://github.com/0xBlackash/CVE-2026-39813","repos":[{"name":"0xBlackash/CVE-2026-39813","url":"https://github.com/0xBlackash/CVE-2026-39813","stars":0,"created":"2026-04-23"},{"name":"HORKimhab/CVE-2026-39813","url":"https://github.com/HORKimhab/CVE-2026-39813","stars":0,"created":"2026-06-17"}]},"first":{"date":"2026-04-23","source":"PoC-in-GitHub","url":"https://github.com/0xBlackash/CVE-2026-39813"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-39813","provenance":"source"},{"date":"2026-04-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/0xBlackash/CVE-2026-39813","provenance":"source"},{"date":"2026-06-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-39813","provenance":"source"}],"speed":{"daysToPublicExploit":9,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 138 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.54,"detail":"percentile 0.9768"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}