EUVD-2025-209457
GHSA-w5r2-jfhj-qppp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.7, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
AnalysisAI
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Technical ContextAI
This is a CWE-22 path traversal vulnerability residing in the CLI command processing layer of Fortinet FortiAnalyzer and FortiManager platforms. The affected products fail to properly validate and restrict filesystem paths supplied via CLI arguments, allowing an attacker with administrative credentials to escape intended directory boundaries using techniques such as relative path traversal (e.g., '../') or absolute path references. The vulnerability is not a remote network attack; it requires either local shell access or remote CLI access with high-privilege credentials. The underlying defect is insufficient input sanitization in the file deletion command handler, a common pattern in management platforms that offer privileged administrative CLI interfaces.
RemediationAI
Upgrade to a patched version released by Fortinet for each affected product line. For FortiAnalyzer and FortiManager 7.6.x, upgrade to 7.6.5 or later; for 7.4.x, upgrade to 7.4.8 or later; for 7.2.x, upgrade to 7.2.13 or later; and for 7.0.x, upgrade to 7.0.17 or later. These version increments apply to both on-premises and Cloud variants. Until patching is feasible, restrict CLI access to trusted administrative accounts and monitor CLI command logs for suspicious path traversal attempts (sequences containing '../' or unusual absolute paths in file operation commands). Organizations should prioritize testing patches in non-production environments before deployment to ensure compatibility with existing configurations. Full remediation guidance is documented in the Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-120.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today