Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0, 7.4.0 – ≤ 7.4.4, 7.2.0 – ≤ 7.2.9, 7.0.0 – ≤ 7.0.15, 6.4.0 – ≤ 6.4.15 | — |
| Fortinet | FortiProxy | 7.4.0 – ≤ 7.4.5, 7.2.0 – ≤ 7.2.11, 7.0.0 – ≤ 7.0.18, 2.0.0 – ≤ 2.0.14, 1.2.1 – ≤ 1.2.13, 01.02.00, 1.1.4 – ≤ 1.1.6, 01.01.00 – ≤ 01.01.03, 01.00.00 – ≤ 01.00.07 | — |
| Fortinet | FortiManager | 7.6.0 – ≤ 7.6.1, 7.4.1 – ≤ 7.4.3 | — |
| Fortinet | FortiManager Cloud | 7.4.1 – ≤ 7.4.3 | — |
Advisories 6
- ICSA-25-044-06 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Mar 12, 2026
- SSA-770770 SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Mar 10, 2026
- NCSC-2025-0061 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 14, 2025
- NCSC-2025-0051 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 11, 2025
- NCSC-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2025-0095 Fortinet Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 14, 2025