Root escalation via writable logs and symlinks

Privilege escalation in affected Fortinet FortiManager and FortiAnalyzer releases allows local users with a restricted shell to gain root. World-writable /var/log permissions let the user replace service log files with symlinks, while privileged local services overwrite and append attacker-controlled content to an executable. A non-root administrative-domain login then triggers the executable as root, enabling full appliance control.