CVE-2022-41328: FortiOS path traversal lets privileged CLI user read and write system files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed exploitation and high confidentiality and integrity impact, though it requires local privileged access.

What it is

FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 fail to properly restrict pathnames, allowing path traversal (CWE-22). A privileged attacker can use crafted CLI commands to read and write files on the underlying Linux system, breaking the boundary between the management interface and the host OS.

Impact

An attacker with existing privileged CLI access gains arbitrary file read and write on the underlying Linux system, which can expose sensitive data and enable modification of system files. The CVSS vector rates confidentiality and integrity impact as high, with no availability impact.

Attack surface

Reached locally through crafted CLI commands, per the CVSS vector AV:L/PR:L/UI:N, so the attacker needs local access and low-level privileges but no user interaction. It is not described as remotely exploitable without such access.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-14 with a 2023-04-04 remediation due date, indicating known exploitation; EPSS 30-day probability is about 10.7 percent (95.6th percentile). CISA does not list it as used in known ransomware campaigns.

What to do

• Apply the FortiOS updates specified in Fortinet advisory FG-IR-22-369 for the affected 7.2, 7.0 and 6.4 branches.
• Restrict and audit who holds privileged CLI or administrative access to FortiGate devices.
• Monitor and log CLI command usage on FortiOS devices for path traversal patterns.
• Review device file integrity and configuration for unauthorized changes after patching.

Detection

• Search FortiOS CLI and audit logs for commands containing traversal sequences such as ../ or absolute paths targeting system files.
• Alert on privileged CLI sessions that read or write files outside expected configuration paths.
• Correlate FortiGate administrative logins with subsequent file access or configuration changes on the underlying system.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.