CVE-2022-42474: Fortinet FortiOS

Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days.

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests.

Affected products

• Fortinet FortiOS: from 6.2.0, up to and including 6.2.15; from 6.4.0, up to and including 6.4.12; from 7.0.0, up to and including 7.0.9; from 7.2.0, up to and including 7.2.3
• Fortinet FortiProxy: from 1.0.0, up to and including 1.0.7; from 1.1.0, up to and including 1.1.6; from 1.2.0, up to and including 1.2.13; from 2.0.0, up to and including 2.0.11; from 7.0.0, up to and including 7.0.7; version 7.2.0 only; …
• Fortinet Fortiswitchmanager: version 7.0.0 only; version 7.0.1 only; version 7.2.0 only; version 7.2.1 only

Published 2023-06-13. Last modified 2026-06-17.