CVE-2026-22573
Full vulnerability record from the local CVENow database.
Description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5 all versions, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform path traversal attack via File Content Extraction actions.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 16:16:36.550000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-22573",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T16:16:36.550",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5 all versions, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform path traversal attack via File Content Extraction actions."
},
{
"lang": "es",
"value": "Una vulnerabilidad de limitación inadecuada de un nombre de ruta a un directorio restringido (’salto de ruta’) en Fortinet FortiSOAR PaaS 7.6.0 hasta 7.6.3, FortiSOAR PaaS 7.5 todas las versiones, FortiSOAR PaaS 7.4 todas las versiones, FortiSOAR PaaS 7.3 todas las versiones, FortiSOAR on-premise 7.6.0 hasta 7.6.3, FortiSOAR on-premise 7.5 todas las versiones, FortiSOAR on-premise 7.4 todas las versiones, FortiSOAR on-premise 7.3 todas las versiones puede permitir a un atacante remoto autenticado realizar un ataque de salto de ruta a través de acciones de Extracción de Contenido de Archivos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiSOAR on-premise",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiSOAR PaaS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.3",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T16:24:34.309578Z",
"id": "CVE-2026-22573",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.3.0",
"versionEndIncluding": "7.3.3",
"matchCriteriaId": "030CE7E8-05B5-4AE0-AD59-5D07150DEF46"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.4.0",
"versionEndIncluding": "7.4.5",
"matchCriteriaId": "46AD20C7-44D4-4DDE-B74A-BEB8B3890277"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.5.0",
"versionEndIncluding": "7.5.3",
"matchCriteriaId": "86B32392-F2E0-49FE-988A-02CC6D257DBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.6.0",
"versionEndIncluding": "7.6.3",
"matchCriteriaId": "DEB8A1CE-2EB8-43B7-9E9A-0106BF54631E"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-116",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}