{"id":"CVE-2022-39952","aliases":["EUVD-2022-42396","GHSA-4wjq-4wff-qw9c"],"status":"published","title":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5,...","description":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.99794,"percentile":0.99957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-610","CWE-668","CWE-73"],"published":"2023-02-16T18:06:55Z","modified":"2026-06-17T04:58:34Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/fortinac_keyupload_file_write","title":"Fortinet FortiNAC keyUpload.jsp arbitrary file write","type":"exploit","platform":"Linux,Unix","date":"2023-02-16","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/fortinac_keyupload_file_write"},{"source":"nuclei","id":"CVE-2022-39952","title":"Fortinet FortiNAC - Arbitrary File Write","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39952.yaml"},{"source":"pocgithub","id":"Chocapikk/CVE-2022-39952","title":"Chocapikk/CVE-2022-39952","date":"2023-02-26","url":"https://github.com/Chocapikk/CVE-2022-39952"},{"source":"pocgithub","id":"dkstar11q/CVE-2022-39952-better","title":"dkstar11q/CVE-2022-39952-better","date":"2023-03-27","url":"https://github.com/dkstar11q/CVE-2022-39952-better"},{"source":"pocgithub","id":"horizon3ai/CVE-2022-39952","title":"horizon3ai/CVE-2022-39952","date":"2023-02-20","url":"https://github.com/horizon3ai/CVE-2022-39952"},{"source":"pocgithub","id":"shiyeshu/CVE-2022-39952_webshell","title":"shiyeshu/CVE-2022-39952_webshell","date":"2023-02-22","url":"https://github.com/shiyeshu/CVE-2022-39952_webshell"}],"products":[{"vendor":"fortinet","product":"fortinac"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-300","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39952"},{"url":"https://github.com/advisories/GHSA-4wjq-4wff-qw9c"}],"sources":{"cve":[{"id":"CVE-2022-39952","description":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","status":"published","published":"2023-02-16T18:06:55.108Z","modified":"2024-10-23T14:32:41.984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-42396","description":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","status":"published","published":"2023-02-16T18:06:55Z","modified":"2024-10-23T14:32:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","level":"critical"}],"updated_at":"2026-11-03T00:05:21.424716Z"}],"ghsa":[{"id":"GHSA-4wjq-4wff-qw9c","title":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5,...","description":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","status":"published","published":"2023-02-16T21:30:27Z","modified":"2023-03-04T05:08:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-610"],"updated_at":"2026-11-02T14:54:16.644116Z"}],"nvd":[{"id":"CVE-2022-39952","description":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","status":"published","published":"2023-02-16T19:15:13.06Z","modified":"2026-06-17T04:58:34.47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-73","CWE-668"],"updated_at":"2026-11-02T14:07:36.026349Z"}]}}