CVE-2026-22573

published 2026-04-14

CVE-2026-22573: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS…

Priority P3 44 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5 all versions, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform path traversal attack via File Content Extraction actions.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortisoar	—	—
fortinet	fortisoar	7.3.0 – 7.3.3	—
fortinet	fortisoar	7.4.0 – 7.4.5	—
fortinet	fortisoar	7.5.0 – 7.5.3	—
fortinet	fortisoar	7.6.0 – 7.6.3	—
fortinet	fortisoar_on-premise	7.3.0 – 7.3.3	—
fortinet	fortisoar_on-premise	7.4.0 – 7.4.5	—
fortinet	fortisoar_on-premise	7.5.0 – 7.5.3	—
fortinet	fortisoar_on-premise	7.6.0 – 7.6.3	—
fortinet	fortisoar_paas	7.3.0 – 7.3.3	—
fortinet	fortisoar_paas	7.4.0 – 7.4.5	—
fortinet	fortisoar_paas	7.5.0 – 7.5.3	—
fortinet	fortisoar_paas	7.6.0 – 7.6.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22