PSIRT XSS via back button Summary An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox may allow an unauthenticated attacker to execute commands via crafted requests. FortiSandbox PaaS versions 4.4.8 and 5.0.5 contains the fix for this vulnerability. Version Affected Solution FortiSandbox 5.0 5.0.0 through 5.0.1 Upgrade to 5.0.2 or above FortiSandbox 4.4 4.4.0 through 4.4.7 Upgrade to 4.4.8 or above FortiSandbox 4.2 4.2 all versions Migrate to a fixed release FortiSandbox 4.0 4.0 all versions Migrate to a fixed release Acknowledgement Internally reported and discovered by Jaguar Perlas of Burnaby Infosec team. Timeline 2026-02-10: Initial publication