Path Traversal in Fortinet FortiVoice allowing privileged file deletion

Successful exploitation allows a privileged attacker to delete arbitrary files accessible from the vulnerable FortiVoice context on the underlying filesystem. This can result in service disruption, loss of application or system data, corruption of configuration or operational files, and potential destabilization of the appliance or application depending on which files are removed.

If immediate patching is not possible, restrict access to the vulnerable FortiVoice HTTP/HTTPS management interfaces to trusted administrative networks only, minimize the number of privileged accounts, enforce least privilege for administrative access, and monitor for suspicious crafted requests and unexpected file deletions. Network segmentation and limiting exposure of management services can reduce exploitation opportunities until updates are applied.

Upgrade FortiVoice to a fixed version outside the affected ranges. The provided content identifies affected versions as 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7, and advises applying Fortinet stable-channel updates immediately after appropriate testing. Administrators should follow Fortinet's official upgrade guidance and move to the vendor-remediated release for their branch.