CVE-2025-54658
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A Path Traversal vulnerability in the Outlookproxy plugin of Fortinet FortiDLP Agent for macOS allows an authenticated attacker to escalate privileges to Root by sending a crafted request to a local listening port.
Risk Assessment
An authenticated attacker can gain full control over the macOS system, leading to data compromise and system integrity violation.
Recommendation
Update FortiDLP Agent to the latest available version that fixes this vulnerability and restrict access to local listening ports.
Other vulnerabilities in Fortinet FortiDLP Agent
See all- CVE-2025-53951Medium
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows versions 11.5.1, 11.4.2-11.4.6, 11.3.2-11.3.4, 11.2.0-11.2.3, 11.1.1-11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port.
- CVE-2025-53950Medium
An Exposure of Private Personal Information ('Privacy Violation') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows in versions 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
Original NVD description (English source)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to Root via sending a crafted request to a local listening port.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS