CVE-2025-53609

medium · 4.9

A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.

4.9

CVSS

10.6%

EPSS (exploit prob.)

96th

EPSS percentile

2025-09-09

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-23

Affected products

Vendor	Product	Affected versions
fortinet	fortiweb	>= 7.0.2, < 7.2.12
fortinet	fortiweb	>= 7.4.0, < 7.4.9
fortinet	fortiweb	>= 7.6.0, < 7.6.5

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-512

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-53609