EUVD-2025-209452
GHSA-f3vf-64gv-cxr8
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
AnalysisAI
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Technical ContextAI
The vulnerability stems from insufficient input validation in CLI command processing across multiple Fortinet products (FortiOS, FortiProxy, FortiPAM, FortiSwitchManager). CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates that the affected CLI command handlers fail to properly sanitize or restrict file paths supplied by users, allowing directory traversal sequences (e.g., '../') to escape intended file boundaries. The attack surface is CLI-based, meaning it requires local or remote access to the command-line interface with authenticated credentials holding the admin profile and explicit read-write permissions. The local attack vector (AV:L) and high privilege requirement (PR:H) narrow the attack scope to authenticated administrators, but the integrity and availability impacts are significant-successful exploitation enables unauthorized file write/delete operations that can alter system configuration, disable security features, or cause denial of service.
RemediationAI
Organizations must apply vendor-released patches immediately. For FortiOS, upgrade to versions 7.6.5 or later (for 7.6.x branch), 7.4.10 or later (for 7.4.x branch), or equivalent patched versions for earlier branches; FortiProxy should be upgraded to 7.6.5 or later, 7.4.12 or later, or patched equivalents for 7.2.x and 7.0.x. FortiPAM should be upgraded to 1.7.1 or later; if running earlier versions (1.0-1.6), upgrade to the latest patched release for each branch or contact Fortinet support for backport patches. FortiSwitchManager should be upgraded to 7.2.8 or later or 7.0.7 or later depending on the branch. As an interim mitigation, organizations should restrict CLI access to trusted administrators, disable read-write CLI permissions for all non-essential admin accounts, enforce strong authentication for admin access, monitor and audit all CLI commands for path traversal attempts (looking for '../' or similar sequences), and review admin account permissions to ensure least-privilege principles are applied. Detailed remediation guidance is available at https://fortiguard.fortinet.com/psirt/FG-IR-26-122.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today