CVE-2018-13379
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Published Jun 4, 2019 · updated Jun 16, 2026 · fortinet fortiproxy
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Timeline
Detection, updates, and resolution for this record.
Jun 4, 2019 · Catalog
Detected
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe fortinet/fortiosversion unspecified
- cpe fortinet/fortiproxyversion unspecified
- cpe fortinet/fortiproxy2.0.0
- vendor Fortinet FortiOSversion unspecified
Sources
- CISA KEVCVE-2018-13379
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
cisa.gov - CVE.orgCVE-2018-13379
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-13379
30-day exploitation probability 100.0%
first.org - Exploit Database47287
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47288
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_gather/fortios_vpnssl_traversal_creds_leak
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2018-13379
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacke
nvd.nist.gov