CVE-2025-25254: Fortinet FortiWeb Path Traversal Flaw

CVE-2025-25254 Overview

CVE-2025-25254 is a path traversal vulnerability [CWE-22] affecting Fortinet FortiWeb. The flaw resides in an administrative endpoint that fails to properly restrict pathname inputs. An authenticated administrator can submit crafted requests to read and modify files outside the intended directory scope.

Affected versions include FortiWeb 7.6.2 and below, 7.4.6 and below, and all releases of 7.2 and 7.0. The vulnerability requires high privileges and no user interaction, but its network attack vector and full impact on confidentiality, integrity, and availability make it a meaningful risk in environments where administrative accounts may be shared or compromised.

Critical Impact

An authenticated administrator can traverse the FortiWeb filesystem to access and modify arbitrary files, undermining the integrity of the web application firewall.

Affected Products

• Fortinet FortiWeb 7.6.2 and below
• Fortinet FortiWeb 7.4.6 and below
• Fortinet FortiWeb 7.2 (all versions) and 7.0 (all versions)

Discovery Timeline

• 2025-04-08 - CVE-2025-25254 published to the National Vulnerability Database (NVD)
• 2025-07-22 - Last updated in NVD database

Technical Details for CVE-2025-25254

Vulnerability Analysis

FortiWeb exposes an administrative endpoint that accepts file path parameters as part of normal management operations. The endpoint does not sufficiently validate or canonicalize these parameters before using them in filesystem operations. An authenticated administrator can supply crafted input containing traversal sequences such as ../ to escape the intended directory and reach arbitrary files on the appliance.

Because the affected logic supports both read and write operations, exploitation enables file disclosure and file modification. Attackers can target configuration files, web application firewall rule sets, certificate stores, and binaries used by the device runtime.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The vulnerable endpoint concatenates or resolves user-controlled path components without rejecting parent-directory references or enforcing a strict allowlist of permitted paths.

Attack Vector

An attacker must hold valid administrative credentials on the FortiWeb management interface. With those credentials, the attacker issues crafted HTTP requests over the network to the vulnerable endpoint. No user interaction is required. Successful exploitation yields read and write access to the underlying filesystem within the privileges of the FortiWeb management process.

The vulnerability is documented in the Fortinet Security Advisory FG-IR-24-474. No public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2025-25254

Indicators of Compromise

• HTTP requests to FortiWeb administrative endpoints containing path traversal sequences such as ../, ..%2f, or encoded variants in path or query parameters.
• Unexpected modifications to FortiWeb configuration, rule, or certificate files outside of normal change windows.
• Administrative session activity originating from unusual source addresses or at atypical times.

Detection Strategies

• Inspect FortiWeb management plane logs for requests referencing absolute paths or traversal patterns on file-handling endpoints.
• Correlate authenticated administrator sessions with subsequent filesystem-impacting operations to surface anomalous workflows.
• Hash and baseline critical FortiWeb configuration and binary files, then alert on unauthorized changes.

Monitoring Recommendations

• Forward FortiWeb administrative and audit logs to a centralized SIEM or data lake for long-term retention and correlation.
• Alert on administrative logins followed by file management API calls outside approved maintenance windows.
• Track failed and successful authentication attempts against the FortiWeb management interface to identify credential abuse leading up to exploitation.

How to Mitigate CVE-2025-25254

Immediate Actions Required

• Upgrade FortiWeb to a fixed release as documented in the Fortinet PSIRT advisory FG-IR-24-474.
• Restrict access to the FortiWeb management interface to a small set of trusted administrative networks.
• Rotate administrator credentials and enforce multi-factor authentication on all FortiWeb admin accounts.
• Review FortiWeb audit logs for evidence of traversal attempts or unexpected file modifications.

Patch Information

Fortinet has published guidance and fixed versions in the Fortinet Security Advisory FG-IR-24-474. Administrators should upgrade FortiWeb beyond version 7.6.2 on the 7.6 branch and beyond 7.4.6 on the 7.4 branch. Versions in the 7.2 and 7.0 branches are affected in full and should be migrated to a supported fixed release.

Workarounds

• Limit administrative interface exposure to dedicated management VLANs or VPN-only access until patching is complete.
• Reduce the number of accounts holding FortiWeb super-administrator privileges and apply least privilege to operational roles.
• Monitor and alert on any administrative API calls that include path separators or encoded traversal sequences in parameters.

# Restrict FortiWeb administrative access to trusted hosts
config system interface
  edit "port1"
    set allowaccess https ssh
    set trusthost1 10.0.0.0 255.255.255.0
  next
end