NewsFortinet PSIRT2026-04-14 07:00 UTC

Arbitrary directory delete on vmimages delete feature

CVSSv3 Score: 6.2 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS and FortiSandbox Cloud WEB UI may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests. Revised on 2026-04-14 00:00:00

Other advisories

CVE-2026-91980none
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
CVE-2026-91980medium
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
CVE-2026-91984medium
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-91984none
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-103267none
Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
osv:CLEANSTART-2026-ED67478none
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
osv:CLEANSTART-2026-BP22763none
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
osv:CLEANSTART-2026-PV83976none
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Other news entries

Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-115

More on Arbitrary