Improper limitation of a pathname to a restricted directory

Summary

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

This has been reported to be exploited in the wild, customers are urged to apply the workaround below.

Please note that Fortinet has remediated this issue on oct 05, 2026 in FortiMail Cloud by updating all the firmwares to v7.6.7 GA or v8.0.2 GA, hence the FortiMail Cloud customers need not perform any action.

Workaround:

Disable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command:

config system encryption ibe
set status disable
end

Alternatively:
- Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted private network
- Or if there is a Web Application Firewall in front of FortiMail, block POST requests to /ibe that contain '../'

Indicators of Compromise (IoC):

IPs:

79[.]141.169.187
45[.]129.0.192

System Event Logs:

- type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...
- type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."
- type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1] rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"

Encryption Logs:

- FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'
- Internal user *@domain.tld<mailto:*@domain.tld> failed to log in.

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team

Virtual Patch

No

Timeline

2026-10-01: Initial publication
2026-10-05: Solution update
2026-10-07: FortiMail Cloud fix clarification