An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4…
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Fortinet
- Product
- FortiManager, FortiAnalyzer, FortiManager Cloud
- CVSS v3.1
- 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Exploitation
- SSVC none, automatable no, impact total
- Weakness
- CWE-22
- Exposure class
- Network management
- NVD status
- Received
Why it ranks 30 (Notable)
- CVSS v3.1 8.1 high
- SSVC: total technical impact
- Product class: network management
- Widely deployed vendor product (Fortinet)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2025-61625 on this site · NVD · CVE.org · Vulnpedia