{"id":"CVE-2026-126220","aliases":["EUVD-2026-123874","GHSA-qgvh-f5jm-9835"],"status":"published","title":"A improper neutralization of special elements in output used by a downstream component (...","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0037,"percentile":0.31412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2026-11-11T21:31:24.528Z","modified":"2026-11-12T00:33:03Z","products":[{"vendor":"fortinet","product":"fortimanager"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126220"},{"url":"https://github.com/advisories/GHSA-qgvh-f5jm-9835"}],"sources":{"cve":[{"id":"CVE-2026-126220","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","status":"published","published":"2026-11-11T21:31:24.528Z","modified":"2026-11-11T21:31:24.528Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-11T22:33:40.554088Z"}],"euvd":[{"id":"EUVD-2026-123874","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","status":"published","published":"2026-11-12T00:32:57Z","modified":"2026-11-12T00:32:57Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-12T01:31:24.707094Z"}],"ghsa":[{"id":"GHSA-qgvh-f5jm-9835","title":"A improper neutralization of special elements in output used by a downstream component (...","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","status":"published","published":"2026-11-12T00:32:57Z","modified":"2026-11-12T00:33:03Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2026-126220","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","status":"published","published":"2026-11-11T22:17:19.79Z","modified":"2026-11-11T22:17:19.79Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-11T23:26:41.421267Z"}]}}