← Back

CVE-2024-40588

nvd nist
Published: Aug 12, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.4
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploitability: 0.8 / Impact: 3.6
Source: psirt@fortinet.com (Secondary)

Description

Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0 all versions, FortiMail 7.6.0 through 7.6.1, FortiMail 7.4.0 through 7.4.3, FortiMail 7.2 all versions, FortiMail 7.0 all versions, FortiMail 6.4 all versions, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.6, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiRecorder 6.4 all versions, FortiVoice 7.0.0 through 7.0.3, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests.

Affected (9)

Fortinet
5 products
Forticamera Firmware
Fortimail
Fortindr
Fortirecorder
Fortivoice
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Forticamera Firmware
From 2.0.0 to 2.1.4
Running on/withPlatform Versions
Fortinet
Forticamera
All versions
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortimail
From 6.4.0 to 7.4.4
Fortimail
From 7.6.0 to 7.6.2
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortindr
From 7.0.0 to 7.4.7
Fortindr
From 7.6.0 to 7.6.2
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortirecorder
From 6.4.0 to 7.0.5
Fortirecorder
From 7.2.0 to 7.2.2
Configuration E
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortivoice
From 6.0.0 to 6.4.10
Fortivoice
From 7.0.0 to 7.0.5

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.