This vulnerability involves improper limitation of a pathname to a restricted directory (path traversal) in Fortinet FortiProxy and other Fortinet products. Exploitation could allow an attacker with high privileges to execute unauthorized code or commands. The affected FortiProxy versions include 7.6.0 through 7.6.5, 7.4 through 7.4.13, 7.2 all versions, and 7.0 all versions. The CVSS 3.1 base score is 5.0, reflecting medium severity with partial impact on integrity and availability but no confidentiality impact. The vendor has released an official fix to address this issue.

An attacker with high privileges can exploit this path traversal vulnerability to execute unauthorized code or commands on affected FortiProxy versions. The impact includes potential integrity and availability compromise of the system. Confidentiality is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

An official fix is available from Fortinet for the affected FortiProxy versions. It is recommended to apply the vendor-provided patches promptly to remediate this vulnerability. Since the vulnerability requires high privileges, limiting administrative access and following Fortinet's update guidance will reduce risk.