Vulnerabilities/Fortinet/CVE-2018-13379
CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Recommended action
Apply updates per vendor instructions.
CISA due date 3 May 2022 · CWE-22
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy | FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12, FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 3 Nov 2021 · Added to CISA KEV
- 3 May 2022 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.