Fortinet FortiMail Path Traversal (CVE-2026-126153)
CVE-2026-126153 is a path traversal vulnerability in multiple versions of Fortinet FortiMail that allows unauthenticated attackers to execute unauthorized commands via crafted requests.
CVE search metadata
CVE search record: CVE-2026-126153. Severity: high. CVSS: 7.5. KEV: no. Product: FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail Path Traversal (CVE-2026-126153). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-path-traversal-cve-2026-126153/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2 are affected by an improper limitation of a pathname to a restricted directory vulnerability, also known as path traversal. This flaw allows an unauthenticated attacker to execute unauthorized commands via crafted requests.
Impact
Successful exploitation allows an unauthenticated attacker to execute unauthorized commands on the target appliance.