A sensitive information exposure vulnerability exists in Fortinet FortiOS versions 7.6.0–7.6.1, 7.4.0–7.4.6, and earlier affected releases. A remote unauthenticated attacker may bypass a security patch related to symbolic link persistence mechanisms using specially crafted HTTP requests. Exploitation requires the attacker to have already compromised the device through another filesystem-level vulnerability.