CVE-2025-60024
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0
Severity
High 7.7
CVSS 3.1
Exploited
Not listed
EPSS
0.005
38.9th percentile
Discovered by
Vendor
Vendor advisory field
Published
Dec 9, 2025
Assigned by fortinet
Description
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands
Weakness: CWE-22
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiVoice | Other Products | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiVoice
Credit
Internally discovered and reported by Jaguar Perlas from Burnbaby Infosec team.
Vendor remediation
Upgrade to FortiVoice version 7.2.3 or above Upgrade to FortiVoice version 7.0.8 or above