CVE-2025-64446
CriticalSummary
A relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11 may allow an attacker to execute administrative commands via crafted HTTP or HTTPS requests.
Risk Assessment
An attacker can remotely execute administrative commands, potentially leading to full compromise of the FortiWeb system and the applications it protects.
Recommendation
Update FortiWeb to a patched version. Restrict access to management interfaces and monitor logs for suspicious requests.
Original NVD description (English source)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.