CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.

Severity
Medium 6.7
CVSS 3.1
Exploited
Yes — in CISA KEV
Added Nov 18, 2025
EPSS
0.556
99.0th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 18, 2025
Assigned by fortinet

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Discovered by Fortinet Threat intelligence with additional thanks to Jason McFadyen from Trend Research (Trend Micro).

Vendor remediation

Upgrade to FortiWeb version 8.0.2 or above Upgrade to FortiWeb version 7.6.6 or above Upgrade to FortiWeb version 7.4.11 or above Upgrade to FortiWeb version 7.2.12 or above Upgrade to FortiWeb version 7.0.12 or above

Something wrong here?