Cross-site Scripting Vulnerability in Fortinet FortiSandbox Products
CVE-2025-52436

7.9HIGH

Key Information:

Vendor

Fortinet
Status
Fortisandbox
Vendor
CVE Published:
10 February 2026

What is CVE-2025-52436?

The vulnerability in Fortinet FortiSandbox allows an unauthenticated attacker to exploit an improper input neutralization during web page generation. This can lead to executing arbitrary commands via specially crafted requests, posing significant risks for users of affected versions, including FortiSandbox 5.0.0 through 5.0.1 and 4.4.0 through 4.4.7, among others. Proper input validation and sanitization measures must be adopted to mitigate potential threats.

Affected Version(s)

FortiSandbox 5.0.0 <= 5.0.1

FortiSandbox 4.4.0 <= 4.4.7

FortiSandbox 4.2.1 <= 4.2.8

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-093

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.