CVE-2025-64446

The attacker sends specially crafted HTTP or HTTPS requests containing path traversal sequences (e.g., '../'), which bypass path access control mechanisms. As a result, requests reach system components normally inaccessible to unauthenticated users. The vulnerability allows execution of administrative commands without requiring any credentials, corresponding to the CVSS vector AV:N/AC:L/PR:N/UI:N.

An unauthenticated attacker can execute arbitrary administrative commands on the FortiWeb device, leading to complete device compromise — loss of confidentiality, integrity, and system availability.

Apply patches available from the vendor according to references (https://fortiguard.fortinet.com/psirt/FG-IR-25-910). Until updates are applied, it is recommended to restrict access to the FortiWeb management interface to trusted IP addresses only and monitor anomalous HTTP/HTTPS requests directed to the administrative panel.

Fortinet FortiWeb in versions: 8.0.0–8.0.1, 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.0–7.2.11, 7.0.0–7.0.11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.