CVE-2025-61624

Published Apr 14, 2026 CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Listed

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiOS

unaffected

Version	Status	Constraints
`7.6.0`	affected	≤ 7.6.4
`7.4.0`	affected	≤ 7.4.9
`7.2.0`	affected	≤ 7.2.13
`7.0.0`	affected	≤ 7.0.19
`6.4.0`	affected	≤ 6.4.16

Fortinet

FortiProxy

unaffected

Version	Status	Constraints
`7.6.0`	affected	≤ 7.6.4
`7.4.0`	affected	≤ 7.4.11
`7.2.0`	affected	≤ 7.2.16
`7.0.0`	affected	≤ 7.0.23

Fortinet

FortiSwitchManager

unaffected

Version	Status	Constraints
`7.2.0`	affected	≤ 7.2.7
`7.0.0`	affected	≤ 7.0.6

Fortinet

FortiPAM

unaffected

Version	Status	Constraints
`1.7.0`	affected	—
`1.6.0`	affected	≤ 1.6.2
`1.5.0`	affected	≤ 1.5.1
`1.4.0`	affected	≤ 1.4.3
`1.3.0`	affected	≤ 1.3.1
`1.2.0`	affected	—
`1.1.0`	affected	≤ 1.1.2
`1.0.0`	affected	≤ 1.0.3

Configuration 1 [-]

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::

Configuration 2 [-]

cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*

Configuration 3 [-]

OR	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::

Configuration 4 [-]

OR	cpe:2.3:a:fortinet:fortiswitchmanager::::::::
	cpe:2.3:a:fortinet:fortiswitchmanager::::::::

Configuration 5 [-]

AND

cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Fortinet

Fortios

Version	Status	Scheme	Platform
`[7.6.0,7.6.4]`	affected	semver	—
`[7.4.0,7.4.9]`	affected	semver	—
`[7.2.0,7.2.13]`	affected	semver	—
`[7.0.0,7.0.19]`	affected	semver	—
`[6.4.0,6.4.16]`	affected	semver	—

Fortinet

Fortipam

Version	Status	Scheme	Platform
`1.7.0`	affected	semver	—
`[1.6.0,1.6.2]`	affected	semver	—
`[1.5.0,1.5.1]`	affected	semver	—
`[1.4.0,1.4.3]`	affected	semver	—
`[1.3.0,1.3.1]`	affected	semver	—
`1.2.0`	affected	semver	—
`[1.1.0,1.1.2]`	affected	semver	—
`[1.0.0,1.0.3]`	affected	semver	—

Fortinet

Fortiproxy

Version	Status	Scheme	Platform
`[7.6.0,7.6.4]`	affected	semver	—
`[7.4.0,7.4.11]`	affected	semver	—
`[7.2.0,7.2.16]`	affected	semver	—
`[7.0.0,7.0.23]`	affected	semver	—

Fortinet

Fortiswitchmanager

Version	Status	Scheme	Platform
`[7.2.0,7.2.7]`	affected	semver	—
`[7.0.0,7.0.6]`	affected	semver	—

Remediation

Vendor Solution

Upgrade to upcoming FortiOS version 8.0.0 or above Upgrade to FortiOS version 7.6.5 or above Upgrade to FortiOS version 7.4.10 or above Upgrade to FortiProxy version 7.6.5 or above Upgrade to FortiProxy version 7.4.12 or above Upgrade to FortiPAM version 1.8.0 or above Upgrade to FortiPAM version 1.7.1 or above Fortinet remediated this issue in FortiSASE version 25.4.b and hence customers do not need to perform any action. Upgrade to upcoming FortiSwitch version 8.0.0 or above Upgrade to FortiSwitch version 7.6.5 or above Upgrade to FortiSwitch version 7.4.9 or above Upgrade to FortiSwitchManager version 7.2.8 or above Upgrade to FortiSwitchManager version 7.0.7 or above

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Oct. 16, 2026.

Exploit prediction score: 1.4% (1.395% probability within 30 days)

Exploitation active

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-975644.html
https://fortiguard.fortinet.com/psirt/FG-IR-26-122
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624

History

Oct 17, 2026 11:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Fortinet Path Traversal Allowing Arbitrary File Write

Oct 17, 2026 12:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 16, 2026 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Siemens Siemens ruggedcom Ape1808 Siemens ruggedcom Ape1808 Firmware
CPEs		cpe:2.3:h:siemens:ruggedcom_ape1808:-:::::::* cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:::::::*
Vendors & Products		Siemens Siemens ruggedcom Ape1808 Siemens ruggedcom Ape1808 Firmware

Oct 16, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624

Oct 16, 2026 5:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-10-16T00:00:00+00:00', 'dueDate': '2026-10-19T00:00:00+00:00'}`

Oct 15, 2026 8:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

Oct 15, 2026 7:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 12, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-975644.html

Apr 22, 2026 7:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:fortinet:fortiproxy:::::::: cpe:2.3:a:fortinet:fortiswitchmanager:::::::: cpe:2.3:o:fortinet:fortios:::::::: cpe:2.3:o:fortinet:fortipam::::::::

Apr 15, 2026 3:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Fortinet Path Traversal Allowing Arbitrary File Write

Apr 14, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 14, 2026 4:00 PM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
First Time appeared		Fortinet Fortinet fortios Fortinet fortipam Fortinet fortiproxy Fortinet fortiswitchmanager
Weaknesses		CWE-22
CPEs		cpe:2.3:a:fortinet:fortiproxy:7.0.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.12:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.13:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.14:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.15:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.16:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.17:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.18:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.19:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.20:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.21:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.22:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.23:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.12:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.13:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.14:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.15:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.16:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.4:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.2:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.3:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.4:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.5:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.0.6:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.6:::::::* cpe:2.3:a:fortinet:fortiswitchmanager:7.2.7:::::::* cpe:2.3:o:fortinet:fortios:6.4.0:::::::* cpe:2.3:o:fortinet:fortios:6.4.10:::::::* cpe:2.3:o:fortinet:fortios:6.4.11:::::::* cpe:2.3:o:fortinet:fortios:6.4.12:::::::* cpe:2.3:o:fortinet:fortios:6.4.13:::::::* cpe:2.3:o:fortinet:fortios:6.4.14:::::::* cpe:2.3:o:fortinet:fortios:6.4.15:::::::* cpe:2.3:o:fortinet:fortios:6.4.16:::::::* cpe:2.3:o:fortinet:fortios:6.4.1:::::::* cpe:2.3:o:fortinet:fortios:6.4.2:::::::* cpe:2.3:o:fortinet:fortios:6.4.3:::::::* cpe:2.3:o:fortinet:fortios:6.4.4:::::::* cpe:2.3:o:fortinet:fortios:6.4.5:::::::* cpe:2.3:o:fortinet:fortios:6.4.6:::::::* cpe:2.3:o:fortinet:fortios:6.4.7:::::::* cpe:2.3:o:fortinet:fortios:6.4.8:::::::* cpe:2.3:o:fortinet:fortios:6.4.9:::::::* cpe:2.3:o:fortinet:fortios:7.0.0:::::::* cpe:2.3:o:fortinet:fortios:7.0.10:::::::* cpe:2.3:o:fortinet:fortios:7.0.11:::::::* cpe:2.3:o:fortinet:fortios:7.0.12:::::::* cpe:2.3:o:fortinet:fortios:7.0.13:::::::* cpe:2.3:o:fortinet:fortios:7.0.14:::::::* cpe:2.3:o:fortinet:fortios:7.0.15:::::::* cpe:2.3:o:fortinet:fortios:7.0.16:::::::* cpe:2.3:o:fortinet:fortios:7.0.17:::::::* cpe:2.3:o:fortinet:fortios:7.0.18:::::::* cpe:2.3:o:fortinet:fortios:7.0.19:::::::* cpe:2.3:o:fortinet:fortios:7.0.1:::::::* cpe:2.3:o:fortinet:fortios:7.0.2:::::::* cpe:2.3:o:fortinet:fortios:7.0.3:::::::* cpe:2.3:o:fortinet:fortios:7.0.4:::::::* cpe:2.3:o:fortinet:fortios:7.0.5:::::::* cpe:2.3:o:fortinet:fortios:7.0.6:::::::* cpe:2.3:o:fortinet:fortios:7.0.7:::::::* cpe:2.3:o:fortinet:fortios:7.0.8:::::::* cpe:2.3:o:fortinet:fortios:7.0.9:::::::* cpe:2.3:o:fortinet:fortios:7.2.0:::::::* cpe:2.3:o:fortinet:fortios:7.2.10:::::::* cpe:2.3:o:fortinet:fortios:7.2.11:::::::* cpe:2.3:o:fortinet:fortios:7.2.12:::::::* cpe:2.3:o:fortinet:fortios:7.2.13:::::::* cpe:2.3:o:fortinet:fortios:7.2.1:::::::* cpe:2.3:o:fortinet:fortios:7.2.2:::::::* cpe:2.3:o:fortinet:fortios:7.2.3:::::::* cpe:2.3:o:fortinet:fortios:7.2.4:::::::* cpe:2.3:o:fortinet:fortios:7.2.5:::::::* cpe:2.3:o:fortinet:fortios:7.2.6:::::::* cpe:2.3:o:fortinet:fortios:7.2.7:::::::* cpe:2.3:o:fortinet:fortios:7.2.8:::::::* cpe:2.3:o:fortinet:fortios:7.2.9:::::::* cpe:2.3:o:fortinet:fortios:7.4.0:::::::* cpe:2.3:o:fortinet:fortios:7.4.1:::::::* cpe:2.3:o:fortinet:fortios:7.4.2:::::::* cpe:2.3:o:fortinet:fortios:7.4.3:::::::* cpe:2.3:o:fortinet:fortios:7.4.4:::::::* cpe:2.3:o:fortinet:fortios:7.4.5:::::::* cpe:2.3:o:fortinet:fortios:7.4.6:::::::* cpe:2.3:o:fortinet:fortios:7.4.7:::::::* cpe:2.3:o:fortinet:fortios:7.4.8:::::::* cpe:2.3:o:fortinet:fortios:7.4.9:::::::* cpe:2.3:o:fortinet:fortios:7.6.0:::::::* cpe:2.3:o:fortinet:fortios:7.6.1:::::::* cpe:2.3:o:fortinet:fortios:7.6.2:::::::* cpe:2.3:o:fortinet:fortios:7.6.3:::::::* cpe:2.3:o:fortinet:fortios:7.6.4:::::::* cpe:2.3:o:fortinet:fortipam:1.0.0:::::::* cpe:2.3:o:fortinet:fortipam:1.0.1:::::::* cpe:2.3:o:fortinet:fortipam:1.0.2:::::::* cpe:2.3:o:fortinet:fortipam:1.0.3:::::::* cpe:2.3:o:fortinet:fortipam:1.1.0:::::::* cpe:2.3:o:fortinet:fortipam:1.1.1:::::::* cpe:2.3:o:fortinet:fortipam:1.1.2:::::::* cpe:2.3:o:fortinet:fortipam:1.2.0:::::::* cpe:2.3:o:fortinet:fortipam:1.3.0:::::::* cpe:2.3:o:fortinet:fortipam:1.3.1:::::::* cpe:2.3:o:fortinet:fortipam:1.4.0:::::::* cpe:2.3:o:fortinet:fortipam:1.4.1:::::::* cpe:2.3:o:fortinet:fortipam:1.4.2:::::::* cpe:2.3:o:fortinet:fortipam:1.4.3:::::::* cpe:2.3:o:fortinet:fortipam:1.5.0:::::::* cpe:2.3:o:fortinet:fortipam:1.5.1:::::::* cpe:2.3:o:fortinet:fortipam:1.6.0:::::::* cpe:2.3:o:fortinet:fortipam:1.6.1:::::::* cpe:2.3:o:fortinet:fortipam:1.6.2:::::::* cpe:2.3:o:fortinet:fortipam:1.7.0:::::::*
Vendors & Products		Fortinet Fortinet fortios Fortinet fortipam Fortinet fortiproxy Fortinet fortiswitchmanager
References		https://fortiguard.fortinet.com/psirt/FG-IR-26-122
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C'}`