EUVD-2025-209457
GHSA-w5r2-jfhj-qppp
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.7, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
AnalysisAI
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Technical ContextAI
This is a CWE-22 path traversal vulnerability residing in the CLI command processing layer of Fortinet FortiAnalyzer and FortiManager platforms. The affected products fail to properly validate and restrict filesystem paths supplied via CLI arguments, allowing an attacker with administrative credentials to escape intended directory boundaries using techniques such as relative path traversal (e.g., '../') or absolute path references. The vulnerability is not a remote network attack; it requires either local shell access or remote CLI access with high-privilege credentials. The underlying defect is insufficient input sanitization in the file deletion command handler, a common pattern in management platforms that offer privileged administrative CLI interfaces.
RemediationAI
Upgrade to a patched version released by Fortinet for each affected product line. For FortiAnalyzer and FortiManager 7.6.x, upgrade to 7.6.5 or later; for 7.4.x, upgrade to 7.4.8 or later; for 7.2.x, upgrade to 7.2.13 or later; and for 7.0.x, upgrade to 7.0.17 or later. These version increments apply to both on-premises and Cloud variants. Until patching is feasible, restrict CLI access to trusted administrative accounts and monitor CLI command logs for suspicious path traversal attempts (sequences containing '../' or unusual absolute paths in file operation commands). Organizations should prioritize testing patches in non-production environments before deployment to ensure compatibility with existing configurations. Full remediation guidance is documented in the Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-120.
Share
External POC / Exploit Code
Leaving vuln.today