FortiSandbox
CVE-2025-53679: OS command injection in FortiSandbox, FortiSandbox Cloud
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSandbox 5.0.0 to 5.0.2 | 5.0.3 or later |
| FortiSandbox 4.4.0 to 4.4.7 | 4.4.8 or later |
| FortiSandbox 4.2.1 to 4.2.8 | Upgrade past 4.2.8; see the advisory |
| FortiSandbox 4.0.0 to 4.0.6 | Upgrade past 4.0.6; see the advisory |
| FortiSandbox Cloud 24.1 | See the advisory |
| FortiSandbox Cloud 23.4 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.