← Back

CVE-2025-53609

nvd nist
Published: Sep 9, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.2 / Impact: 3.6
Source: psirt@fortinet.com (Secondary)

Description

A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.

Affected (3)

Products: Fortinet: Fortiweb
Fortinet
1 product
Fortiweb
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiweb
From 7.0.2 to 7.2.12
Fortiweb
From 7.4.0 to 7.4.9
Fortiweb
From 7.6.0 to 7.6.5

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.