EUVD-2025-209452
GHSA-f3vf-64gv-cxr8
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
AnalysisAI
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Technical ContextAI
The vulnerability stems from insufficient input validation in CLI command processing across multiple Fortinet products (FortiOS, FortiProxy, FortiPAM, FortiSwitchManager). CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates that the affected CLI command handlers fail to properly sanitize or restrict file paths supplied by users, allowing directory traversal sequences (e.g., '../') to escape intended file boundaries. The attack surface is CLI-based, meaning it requires local or remote access to the command-line interface with authenticated credentials holding the admin profile and explicit read-write permissions. The local attack vector (AV:L) and high privilege requirement (PR:H) narrow the attack scope to authenticated administrators, but the integrity and availability impacts are significant-successful exploitation enables unauthorized file write/delete operations that can alter system configuration, disable security features, or cause denial of service.
RemediationAI
Organizations must apply vendor-released patches immediately. For FortiOS, upgrade to versions 7.6.5 or later (for 7.6.x branch), 7.4.10 or later (for 7.4.x branch), or equivalent patched versions for earlier branches; FortiProxy should be upgraded to 7.6.5 or later, 7.4.12 or later, or patched equivalents for 7.2.x and 7.0.x. FortiPAM should be upgraded to 1.7.1 or later; if running earlier versions (1.0-1.6), upgrade to the latest patched release for each branch or contact Fortinet support for backport patches. FortiSwitchManager should be upgraded to 7.2.8 or later or 7.0.7 or later depending on the branch. As an interim mitigation, organizations should restrict CLI access to trusted administrators, disable read-write CLI permissions for all non-essential admin accounts, enforce strong authentication for admin access, monitor and audit all CLI commands for path traversal attempts (looking for '../' or similar sequences), and review admin account permissions to ensure least-privilege principles are applied. Detailed remediation guidance is available at https://fortiguard.fortinet.com/psirt/FG-IR-26-122.
Share
External POC / Exploit Code
Leaving vuln.today