EUVD-2025-209452
GHSA-f3vf-64gv-cxr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin credentials with CLI access
-
ExploitConnect to CLI via local/remote interface
-
ExecutionExecute malicious CLI command with path traversal payload
-
ImpactWrite/delete arbitrary files outside intended directory →
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.0 (Medium) with AV:L/AC:L/PR:H/UI:N reflects a moderate baseline risk: local access, high privileges required, no user interaction, and no scope increase. However, real-world risk is context-dependent. The CVSS vector correctly identifies that this is an admin-only vulnerability requiring pre-existing authenticated access and intentional admin privileges-a significant gating factor in most enterprise environments. The impact is high for integrity (file write/delete capability) and availability (potential for system disruption), making it operationally serious if an insider threat or compromised admin account exists. Absence of EPSS, KEV status, or public POC data suggests this is a recently disclosed or low-visibility vulnerability with no confirmed active exploitation. The vulnerability is exploitable but not trivial: an attacker must already possess admin credentials with CLI access and read-write permissions, limiting the threat model to insider threats, compromised admin sessions, or lateral movement scenarios where admin credentials have been stolen. Organizations with strong credential hygiene, least-privilege admin practices, and audit logging of CLI commands are better positioned to mitigate risk despite the high impact per-exploitation. |
| Exploit ScenarioDerived | An authenticated administrator with legitimate CLI access and read-write permissions executes a malicious CLI command containing path traversal sequences (e.g., a file write command targeting '../../../etc/config/important_setting') to write a modified configuration file outside the intended directory, potentially disabling firewall rules, creating a backdoor account, or corrupting critical system files. Alternatively, an attacker who has stolen or phished admin credentials uses the CLI to delete critical system files via similar path traversal sequences, causing a denial of service or system instability. No public POC is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Earlier versions of this analysis (1)
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 and high-privilege requirement (PR:H), real-world impact depends on the prevalence of overly-permissive admin accounts in target environments.
RemediationAI
Organizations must apply vendor-released patches immediately. For FortiOS, upgrade to versions 7.6.5 or later (for 7.6.x branch), 7.4.10 or later (for 7.4.x branch), or equivalent patched versions for earlier branches; FortiProxy should be upgraded to 7.6.5 or later, 7.4.12 or later, or patched equivalents for 7.2.x and 7.0.x. FortiPAM should be upgraded to 1.7.1 or later; if running earlier versions (1.0-1.6), upgrade to the latest patched release for each branch or contact Fortinet support for backport patches. FortiSwitchManager should be upgraded to 7.2.8 or later or 7.0.7 or later depending on the branch. As an interim mitigation, organizations should restrict CLI access to trusted administrators, disable read-write CLI permissions for all non-essential admin accounts, enforce strong authentication for admin access, monitor and audit all CLI commands for path traversal attempts (looking for '../' or similar sequences), and review admin account permissions to ensure least-privilege principles are applied. Detailed remediation guidance is available at https://fortiguard.fortinet.com/psirt/FG-IR-26-122.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from insufficient input validation in CLI command processing across multiple Fortinet products (FortiOS, FortiProxy, FortiPAM, FortiSwitchManager). CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates that the affected CLI command handlers fail to properly sanitize or restrict file paths supplied by users, allowing directory traversal sequences (e.g., '../') to escape intended file boundaries. The attack surface is CLI-based, meaning it requires local or remote access to the command-line interface with authenticated credentials holding the admin profile and explicit read-write permissions. The local attack vector (AV:L) and high privilege requirement (PR:H) narrow the attack scope to authenticated administrators, but the integrity and availability impacts are significant-successful exploitation enables unauthorized file write/delete operations that can alter system configuration, disable security features, or cause denial of service.
Know when Fortios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Exploit-DB