CVE-2026-104286 in FortiMail
Summary
by MITRE • 10/01/2026
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Fortinet FortiMail versions ranging from 8.0.0 through 8.0.1, as well as legacy releases including 7.6.0 through 7.6.6 and 7.4.0 through 7.4.8, represents a critical failure in input validation mechanisms governing file system operations. This flaw is classified under the Common Weakness Enumeration standard as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical issue stems from insufficient sanitization of user-supplied input within the application's HTTP and HTTPS request handling routines. When an attacker submits crafted requests containing maliciously constructed file paths, the system fails to adequately strip or neutralize sequences such as dot-dot-slash (../) or their URL-encoded equivalents. Consequently, the underlying operating system interprets these inputs not as relative references but as absolute path directives, allowing the application to write data outside of its intended secure directory boundaries.
From an operational perspective, this vulnerability allows for arbitrary file writes on the server hosting FortiMail. The ability to write files in unrestricted locations significantly expands the potential impact beyond simple information disclosure or local privilege escalation. An unauthenticated attacker can leverage this flaw to overwrite critical system configuration files, inject malicious scripts into web-accessible directories, or place backdoors within application-specific folders that are executed during routine processes. This capability effectively compromises the integrity of the mail gateway infrastructure, potentially leading to remote code execution if the written content is subsequently interpreted by a service running with elevated privileges. The lack of authentication requirement for this exploit makes it particularly dangerous in internet-facing deployments where automated scanning tools can rapidly identify and target vulnerable instances without needing valid credentials.
The attack vector aligns closely with techniques documented in the MITRE ATT&CK framework, specifically those related to Initial Access via Web Applications and Defense Evasion through file system manipulation. By exploiting this path traversal flaw, an adversary can establish persistence on the network by planting persistent malicious files or disrupt service availability by corrupting essential configuration data. The severity of this vulnerability is compounded by its presence in multiple major release branches, indicating a systemic issue within the codebase's handling of file paths across different versions of the product line. This widespread impact necessitates immediate attention from security operations teams managing FortiMail deployments to prevent exploitation before patches can be applied or mitigations implemented.
To mitigate this risk, organizations must prioritize applying the latest firmware updates provided by Fortinet that address these specific version ranges. For environments where immediate patching is not feasible due to operational constraints, network-level controls should be employed as a compensating measure. This includes configuring web application firewalls to detect and block requests containing path traversal patterns such as ../ or encoded variants like %2e%2e%2f. Additionally, restricting inbound HTTP and HTTPS traffic from untrusted networks to the FortiMail management interface can reduce the attack surface significantly. Regular vulnerability scanning of internet-facing assets is also recommended to identify any instances running vulnerable versions that may have been overlooked during initial deployment or subsequent updates. Ensuring strict adherence to least privilege principles for application services further limits the potential damage if a file write operation succeeds, as restricted permissions would prevent overwriting critical system files even if the path traversal itself is not fully blocked at the network layer.