CVE-2022-42476

A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

CVSS 3.1

8.2CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)

CWEs

CWE-22, CWE-23

Published

2023-03-07

Modified

2026-10-22

Record from

the NVD, synced 2026-10-22

Affected

• fortinet:fortios
• fortinet:fortiproxy

References

• https://fortiguard.com/psirt/FG-IR-22-401
• https://fortiguard.com/psirt/FG-IR-22-401

Check your stackJSON