CVE-2021-41026: Fortinet FortiWeb

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

Affected products

• Fortinet FortiWeb: from 6.3.0, before 6.3.16 (fixed in 6.3.16); from 6.4.0, before 6.4.2 (fixed in 6.4.2)

Published 2022-04-06. Last modified 2026-06-17.