Research · Nov 14, 2025 · ZeroDay Catalog
Critical Path Traversal Vulnerability in Fortinet FortiWeb
A newly discovered path traversal vulnerability in Fortinet FortiWeb could allow attackers to execute administrative commands remotely, affecting multiple versions of the product.
What changed
A relative path traversal vulnerability has been identified in Fortinet's FortiWeb product, specifically affecting versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.11. This vulnerability could potentially allow an attacker to execute administrative commands on the system through specially crafted HTTP or HTTPS requests.
Who is affected
Organizations utilizing Fortinet FortiWeb versions listed above are at risk. This vulnerability could expose sensitive systems to unauthorized administrative access, leading to severe security breaches.
- Fortinet FortiWeb 8.0.0 to 8.0.1
- Fortinet FortiWeb 7.6.0 to 7.6.4
- Fortinet FortiWeb 7.4.0 to 7.4.9
- Fortinet FortiWeb 7.2.0 to 7.2.11
What to do
It is crucial for affected organizations to assess their current FortiWeb deployments and apply necessary updates or patches as soon as they are available from Fortinet. Additionally, monitoring for unusual activity on the affected systems should be prioritized.
- Review and update FortiWeb to the latest version once released.
- Implement monitoring for any unauthorized access attempts.
- Conduct a security audit to identify any potential exploitation of the vulnerability.