CVE-2025-53951
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows versions 11.5.1, 11.4.2-11.4.6, 11.3.2-11.3.4, 11.2.0-11.2.3, 11.1.1-11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port.
Risk Assessment
The risk involves the possibility of privilege escalation by an authenticated attacker, which could lead to gaining access to the system with LocalService privileges and potential security compromise.
Recommendation
It is recommended to update Fortinet FortiDLP Agent to the latest version that includes security fixes, and to restrict access to local listening ports.
Other vulnerabilities in Fortinet FortiDLP Agent
See all- CVE-2025-54658High
A Path Traversal vulnerability in the Outlookproxy plugin of Fortinet FortiDLP Agent for macOS allows an authenticated attacker to escalate privileges to Root by sending a crafted request to a local listening port.
- CVE-2025-53950Medium
An Exposure of Private Personal Information ('Privacy Violation') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows in versions 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
Original NVD description (English source)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS