CyberCVE

CVE-2025-25254

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all version

Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.169
96.9th percentile
Discovered by
Third party
Vendor advisory field
Published
Apr 8, 2025
Assigned by fortinet

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.

Weakness: CWE-22

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Kentaro Kawane of GMO Cybersecurity by Ierae working with Trend Micro Zero Day Initiative for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiWeb version 7.6.3 or above Please upgrade to FortiWeb version 7.4.7 or above

References

Something wrong here?