CVE-2022-41328

Timeline

Detection, updates, and resolution for this record.

1. Mar 7, 2023 · Catalog

   Detected

   A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

2. Mar 14, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 4, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

Affected

• cpe fortinet/fortiosversion unspecified
• vendor Fortinet FortiOSversion unspecified

Sources

• CISA KEVCVE-2022-41328

  Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.

  cisa.gov
• CVE.orgCVE-2022-41328

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2022-41328

  30-day exploitation probability 10.7%

  first.org
• NIST NVDCVE-2022-41328

  A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via c

  nvd.nist.gov

References

• Vendor Advisory · fortiguard.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · fortiguard.com