CVE-2025-53608 — An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests

Back Back to CVE browser

MEDIUM

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests

Published Mar 10, 2026

4.8

MEDIUM

CVSS 3.1

EPSS 0.31%

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests.

Affected products

Vendor Fortinet Product FortiSandbox Default
unaffected
- Version
  4.0.0
  Status
  affected
  Constraints
  <=4.0.6
- Version
  4.2.1
  Status
  affected
  Constraints
  <=4.2.8
- Version
  4.4.0
  Status
  affected
  Constraints
  <=4.4.7
- Version
  5.0.0
  Status
  affected
  Constraints
  <=5.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiSandbox

unaffected

Version	Status	Constraints
4.0.0	affected	<=4.0.6
4.2.1	affected	<=4.2.8
4.4.0	affected	<=4.4.7
5.0.0	affected	<=5.0.2

Remediation

Vendor solution

Upgrade to FortiSandbox version 5.0.3 or above Upgrade to FortiSandbox version 4.4.8 or above Fortinet remediated this issue in FortiSandbox Cloud version 5.0.5 and hence customers do not need to perform any action.