This vulnerability involves improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSOAR on-premise and PaaS versions 7.3 through 7.6.3. Authenticated remote attackers can exploit this flaw through File Content Extraction actions to access files outside the intended directory, resulting in information disclosure. The CVSS 3.1 base score is 6.2 with high confidentiality impact, low attack complexity, and requires low privileges but no user interaction. Fortinet has released an official fix to remediate this vulnerability.

Successful exploitation allows an authenticated remote attacker to read files outside the intended directory scope, leading to unauthorized disclosure of sensitive information. There is no impact on integrity or availability reported. The vulnerability requires authentication and has low attack complexity.

An official fix is available from Fortinet to remediate this vulnerability. Users of affected FortiSOAR on-premise versions 7.3.0 through 7.6.3 should apply the vendor-provided patch promptly to prevent exploitation. Since this is not a cloud service, remediation depends on customer action.