CVE-2025-62675: Fortinet FortiProxy XSS Vulnerability

CVE-2025-62675 Overview

CVE-2025-62675 is an HTTP Response Splitting vulnerability [CWE-113] affecting Fortinet FortiOS and FortiProxy. The flaw stems from improper neutralization of Carriage Return Line Feed (CRLF) sequences in HTTP headers. An attacker holding a valid web filter override token can inject arbitrary headers by tricking a user into clicking a crafted link. Successful exploitation requires user interaction and results in limited integrity impact against the victim's browser session.

Critical Impact
An authenticated attacker with a web filter override token can inject arbitrary HTTP headers into responses, enabling cache poisoning, cross-site scripting, or session-related attacks against users who click a malicious link.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.4, plus all versions of 7.4 and 7.2
Fortinet FortiProxy 7.6.0 through 7.6.4, plus all versions of 7.4 and 7.2
Deployments that expose the web filter override feature to end users

Discovery Timeline

2026-07-14 - CVE-2025-62675 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in the NVD database

Technical Details for CVE-2025-62675

Vulnerability Analysis

The vulnerability resides in the HTTP response construction logic used by the web filter override workflow on FortiOS and FortiProxy. The affected component fails to neutralize CRLF (\r\n) sequences supplied through attacker-controlled input associated with a valid override token. When the response is emitted, the injected sequences terminate the current header block and allow additional headers, or an entirely new response body, to be appended.

Exploitation requires the attacker to already possess a valid web filter override token, and the victim must click a crafted link. The scope remains unchanged and confidentiality and availability are not affected, but integrity of the HTTP response can be manipulated in the user's browser context.

Root Cause

The root cause is missing input sanitization on values that are reflected into HTTP response headers. Because CRLF characters are treated as literal delimiters by HTTP parsers, unsanitized user-supplied data can split a single response into two, enabling smuggled headers or bodies. This class of defect is catalogued as CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts a URL that includes encoded CRLF sequences along with a valid web filter override token. When a targeted user clicks the link, FortiOS or FortiProxy processes the request and reflects the malicious data into the outgoing response headers. The resulting split response can carry injected Set-Cookie values, cache-control directives, or scripted content interpreted by the browser.

No public proof-of-concept exploit is currently listed for this CVE. The Fortinet PSIRT Advisory FG-IR-26-152 provides vendor guidance and fixed-version details.

Detection Methods for CVE-2025-62675

Indicators of Compromise

HTTP requests to FortiOS or FortiProxy web filter override endpoints containing URL-encoded %0d%0a, %0a, or literal CRLF characters in query parameters or the override token context.
Web proxy logs showing responses with duplicated HTTP/1.1 status lines or unexpected Set-Cookie and Content-Type headers originating from the FortiGate or FortiProxy device.
Outbound clicks from user endpoints to Fortinet management or override URLs sourced from external email, chat, or web referrers.

Detection Strategies

Inspect FortiOS and FortiProxy access logs for override-related URIs that contain encoded newline sequences, and alert on any match.
Correlate user-agent click events with subsequent anomalous cookies or redirects delivered by the appliance to identify successful response splitting.
Validate that all responses from the override handler contain a single HTTP status line and expected header set using an inline proxy or IDS signature.

Monitoring Recommendations

Enable verbose HTTP logging on FortiOS and FortiProxy and forward events to a centralized analytics platform for CRLF pattern searches.
Monitor issuance and use of web filter override tokens, including source IP, user, and lifetime, to detect abuse of valid tokens.
Track user reports of unexpected browser redirects or cookie prompts following clicks on links referencing the Fortinet appliance.

How to Mitigate CVE-2025-62675

Immediate Actions Required

Identify all FortiOS 7.6.0–7.6.4, 7.4.x, 7.2.x and FortiProxy 7.6.0–7.6.4, 7.4.x, 7.2.x deployments and prioritize them for upgrade.
Review web filter override token issuance policies and revoke any tokens that are not strictly required.
Warn end users against clicking web filter override links received from untrusted sources.

Patch Information

Fortinet has published remediation guidance in Fortinet PSIRT Advisory FG-IR-26-152. Administrators should upgrade FortiOS and FortiProxy to the fixed builds referenced in that advisory. Because the vulnerability requires a valid override token plus user interaction, patching combined with token hygiene provides the most effective remediation.

Workarounds

Disable the web filter override feature where it is not required by policy.
Restrict which user groups can generate override tokens and shorten token validity periods.
Deploy an upstream reverse proxy or WAF rule that rejects requests containing CRLF sequences in query parameters targeting the override endpoint.

bash

# Example FortiOS CLI: disable web filter override feature per profile
config webfilter profile
    edit "default"
        set options 
        config override
            set ovrd-scope user
            set profile-type list
            set ovrd-dur-mode constant
        end
    next
end