CVE-2025-61624: Fortinet Path Traversal Vulnerability

CVE-2025-61624 Overview

CVE-2025-61624 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability (CWE-22) affecting multiple Fortinet products including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This vulnerability allows an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

The path traversal flaw exists in the command-line interface of affected Fortinet products, enabling privileged users to escape intended directory restrictions. While exploitation requires administrative credentials and local access, successful attacks can result in significant impact to system integrity and availability through unauthorized file manipulation.

Critical Impact

Authenticated administrators can write or delete arbitrary files on affected Fortinet devices, potentially leading to system compromise, configuration tampering, or denial of service.

Affected Products

• Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions, 6.4 all versions
• Fortinet FortiPAM 1.7.0, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions
• Fortinet FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions
• Fortinet FortiSwitchManager 7.2.0 through 7.2.7, 7.0.0 through 7.0.6

Discovery Timeline

• 2026-04-14 - CVE CVE-2025-61624 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2025-61624

Vulnerability Analysis

This path traversal vulnerability stems from insufficient input validation in the CLI command processing of affected Fortinet products. When authenticated administrators execute certain CLI commands, the system fails to properly sanitize file path inputs, allowing directory traversal sequences (such as ../) to escape the intended working directory.

The vulnerability requires local access and high privileges (admin profile with read-write permissions), which limits the attack surface. However, in scenarios where an attacker has compromised administrative credentials or in insider threat situations, this vulnerability enables arbitrary file operations outside permitted directories.

Successful exploitation can lead to complete loss of system integrity through unauthorized file modifications or deletion of critical system files, potentially rendering the device inoperable.

Root Cause

The root cause is improper input validation (CWE-22) in the CLI command handler. The affected Fortinet products do not adequately restrict pathname inputs to the intended restricted directory when processing certain administrative commands. This allows crafted path inputs containing traversal sequences to reference files outside the expected directory scope.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the device's CLI with administrative privileges. The attacker must possess an admin profile with at least read-write permissions to execute the vulnerable commands.

The exploitation scenario involves an authenticated administrator issuing specifically crafted CLI commands that include path traversal sequences. These sequences allow the attacker to navigate outside the restricted directory structure and perform write or delete operations on arbitrary files within the filesystem.

Given the local attack vector and high privilege requirements, this vulnerability is most concerning in scenarios involving:

• Compromised administrator credentials
• Insider threats from privileged users
• Multi-tenant environments with delegated administrative access

Detection Methods for CVE-2025-61624

Indicators of Compromise

• Unusual file system modifications or deletions outside normal administrative directories
• CLI audit logs showing commands with path traversal sequences (e.g., ../, ..\\)
• Unexpected changes to critical system configuration files
• Administrative sessions executing atypical file manipulation commands

Detection Strategies

• Review CLI command logs for directory traversal patterns in file path arguments
• Implement file integrity monitoring on critical system directories
• Audit administrative user sessions for anomalous file operations
• Monitor for unauthorized modifications to configuration files or firmware

Monitoring Recommendations

• Enable comprehensive CLI audit logging on all affected Fortinet devices
• Configure SIEM alerting for commands containing path traversal sequences
• Implement baseline monitoring for administrative session activities
• Deploy file integrity monitoring solutions to detect unauthorized file changes

How to Mitigate CVE-2025-61624

Immediate Actions Required

• Review and update all affected Fortinet products to patched versions as specified in the security advisory
• Audit administrative user accounts and remove unnecessary read-write privileges
• Review CLI audit logs for evidence of exploitation attempts
• Implement additional access controls for administrative CLI sessions

Patch Information

Fortinet has released security patches addressing this vulnerability. Administrators should consult the Fortinet Security Advisory FG-IR-26-122 for specific patched versions and upgrade guidance for each affected product.

Organizations should prioritize patching based on the criticality of affected devices and their exposure to insider threats or potential credential compromise scenarios.

Workarounds

• Restrict administrative CLI access to trusted personnel only
• Implement role-based access control to limit read-write permissions to essential administrators
• Enable and monitor CLI audit logging for all administrative sessions
• Consider network segmentation to limit management interface access
• Implement strong authentication mechanisms including multi-factor authentication for administrative access

# Example: Enable CLI audit logging (consult Fortinet documentation for specific syntax)
# config system global
#     set admin-audit-level command-log
# end