Fortinet FortiSOAR Path Traversal Vulnerability Allowing Arbitrary File Read

A relative path traversal vulnerability has been identified in Fortinet FortiSOAR versions 7.6.0, 7.5.0 through 7.5.1, 7.4 (all versions), and 7.3 (all versions). This vulnerability may allow an authenticated attacker to read arbitrary files by uploading a malicious solution pack.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure by allowing attackers to read sensitive files on the server.

Remediation

Users of Fortinet FortiSOAR 7.6.0 should upgrade to 7.6.1 or above. Users of Fortinet FortiSOAR 7.5.0 through 7.5.1 should upgrade to 7.5.2 or above. Users of Fortinet FortiSOAR 7.4 or 7.3 should migrate to a fixed release.