CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability

Fortinet's bulletin FG-IR-26-122 describes a path traversal (CWE-22) in the CLI: crafted arguments to existing commands let a privileged user write or delete files outside the intended location. The attacker must already hold an admin profile with at least read-write permissions, which is why the vendor scores it medium (CVSS 6.0 in the bulletin, 6.5 in the data panel).

On a firewall or privileged access gateway, arbitrary file write and delete is a strong post-compromise tool. An attacker who has stolen or phished admin credentials, or who got in through another flaw, can use it to alter system files, remove logs and traces, or plant persistence. The bulletin gives no exploitation details, indicators or threat actor, so the way it is being used is not public.

The real risk is the chain: devices with an exposed management interface and weak admin credentials turn a medium bug into a full takeover of a network edge device.

Per the Fortinet bulletin:

• FortiOS 7.6.0 through 7.6.4, and 7.4.0 through 7.4.9; all versions of 7.2, 7.0 and 6.4.
• FortiPAM 1.7.0, and all versions of 1.0 through 1.6. FortiPAM 1.8 is not affected.
• FortiProxy 7.6.0 through 7.6.4, and 7.4.0 through 7.4.11; all versions of 7.2 and 7.0.
• FortiSwitchManager 7.2.0 through 7.2.7, and 7.0.0 through 7.0.6.

Check the firmware version your device reports and compare it with this list. The bulletin documents no command for this.

Upgrade to the fixed release for your branch:

• FortiOS: 7.6.5 or later, or 7.4.10 or later. For 7.2, 7.0 and 6.4, migrate to a fixed release.
• FortiPAM: 1.7.1 or later. For 1.0 through 1.6, migrate to a fixed release.
• FortiProxy: 7.6.5 or later, or 7.4.12 or later. For 7.2 and 7.0, migrate.
• FortiSwitchManager: 7.2.8 or later, or 7.0.7 or later.

Fortinet points to its upgrade tool at docs.fortinet.com/upgrade-tool for planning the path. The bulletin lists no workaround, but a virtual patch is available (FG-VD-59270.0day in FMWP database update 25.120).

CISA's required action: apply mitigations per vendor instructions under BOD 26-04 and its forensics triage requirements, or discontinue use of the product if mitigations are unavailable. The due date was 2026-10-19 and binds US federal agencies.

The bulletin publishes no indicators of compromise. Review administrator logins and CLI command history for unfamiliar accounts, source addresses or times, and for commands run by admins who do not normally use the CLI. Check configuration and file integrity for unexpected changes, and for missing logs, since the flaw also allows deletes. Restrict management access to trusted networks and, where compromise is suspected, follow CISA's forensics triage requirements.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.