Research · Nov 14, 2025
Critical Path Traversal Vulnerability Discovered in Fortinet FortiWeb
A significant path traversal vulnerability has been identified in multiple versions of Fortinet's FortiWeb, potentially allowing unauthorized administrative command execution.
What changed
A newly discovered relative path traversal vulnerability in Fortinet's FortiWeb product could allow attackers to execute unauthorized administrative commands. This vulnerability affects several versions of FortiWeb, highlighting the importance of timely updates and security practices.
- Vulnerability allows execution of administrative commands via crafted HTTP or HTTPS requests.
- Affected versions include FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11.
Who is affected
Organizations utilizing Fortinet's FortiWeb are at risk due to this vulnerability. The following groups should take immediate notice:
- Businesses relying on FortiWeb for web application security.
- IT departments managing FortiWeb versions within the specified ranges.
- Managed service providers offering FortiWeb solutions to clients.
- Any entity using FortiWeb for protecting sensitive data and applications.
What to do
To mitigate the risks associated with this vulnerability, affected users should take the following actions:
- Update FortiWeb to the latest version as recommended by Fortinet.
- Review and monitor system logs for any unauthorized access attempts.
- Implement additional security measures, such as web application firewalls, to protect against potential exploitation.
- Stay informed about security advisories from Fortinet and apply patches promptly.