FortiClientMac - Privilege escalation by abusing a Symlink following vulnerability


A UNIX symbolic link (Symlink) Following (CWE-61) vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root.

Affected Products

FortiClient for MacOS versions 6.4.3 and below.


Please upgrade to FortiClient for MacOS version 6.4.4 or above.
Please upgrade to FortiClient for MacOS version 7.0.0 or above. 


Fortinet is pleased to thank Csaba Fitzl and Trend Micro Zero Day Initiative for bringing this issue to our attention under responsible disclosure.