CVE-2025-25254

high · 7.2

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.

7.2

CVSS

17.1%

EPSS (exploit prob.)

97th

EPSS percentile

2025-04-08

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
fortinet	fortiweb	>= 7.0.0, < 7.4.7
fortinet	fortiweb	>= 7.6.0, < 7.6.3

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-474

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-25254