CVE-2025-64446: Fortinet FortiWeb Path Traversal Flaw

CVE-2025-64446 Overview

A relative path traversal vulnerability (CWE-23) has been identified in Fortinet FortiWeb, a web application firewall product. This critical security flaw affects multiple versions of FortiWeb and allows remote attackers to execute administrative commands on the system via specially crafted HTTP or HTTPS requests. The vulnerability enables unauthenticated attackers to bypass security controls and gain administrative access to the affected systems.

Critical Impact
This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations using affected FortiWeb versions should apply patches immediately as attackers can execute administrative commands without authentication.

Affected Products

Fortinet FortiWeb 8.0.0 through 8.0.1
Fortinet FortiWeb 7.6.0 through 7.6.4
Fortinet FortiWeb 7.4.0 through 7.4.9
Fortinet FortiWeb 7.2.0 through 7.2.11
Fortinet FortiWeb 7.0.0 through 7.0.11

Discovery Timeline

2025-11-14 - CVE-2025-64446 published to NVD
2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-64446

Vulnerability Analysis

This path traversal vulnerability (CWE-23: Relative Path Traversal) exists in Fortinet FortiWeb's request handling mechanism. The flaw allows attackers to craft malicious HTTP or HTTPS requests that traverse directory paths and reach administrative functions. By exploiting improper input validation in the path handling logic, attackers can escape the intended web root directory and execute commands with administrative privileges.

The vulnerability is particularly dangerous because it requires no authentication, can be exploited remotely over the network, and provides complete system compromise capabilities. Successful exploitation grants attackers the ability to execute administrative commands, potentially leading to full device takeover, configuration changes, credential theft, and lateral movement within the network.

Root Cause

The root cause of CVE-2025-64446 is improper validation and sanitization of user-supplied input in file path handling. The FortiWeb application fails to adequately neutralize special path elements (such as ../ sequences) in HTTP/HTTPS requests, allowing attackers to traverse outside the intended directory structure. This relative path traversal weakness enables access to administrative functions and command execution capabilities that should be restricted.

Attack Vector

The attack vector is network-based, requiring no prior authentication or user interaction. An attacker can remotely send specially crafted HTTP or HTTPS requests to the FortiWeb management interface or web services. The malicious requests contain path traversal sequences that bypass access controls and reach administrative endpoints. Once these endpoints are accessed, the attacker can execute arbitrary administrative commands on the underlying system.

The attack can be performed by constructing requests with relative path elements that escape the expected directory context. For technical details on the exploitation methodology, refer to the WatchTowr Labs GitHub PoC Repository and the Fortinet Security Advisory FG-IR-25-910.

Detection Methods for CVE-2025-64446

Indicators of Compromise

HTTP/HTTPS requests containing path traversal sequences such as ../, ..%2f, or encoded variants targeting FortiWeb management interfaces
Unexpected administrative command execution or configuration changes on FortiWeb appliances
Anomalous authentication logs showing administrative access from unexpected sources or without proper authentication
Network traffic to FortiWeb management ports containing unusual path patterns or encoded directory traversal attempts

Detection Strategies

Monitor web server access logs for requests containing path traversal patterns (../, ..%2f, %2e%2e/, etc.) targeting FortiWeb endpoints
Implement network intrusion detection rules to identify HTTP/HTTPS requests with encoded path traversal sequences
Enable detailed logging on FortiWeb devices and correlate administrative command execution with access patterns
Deploy web application firewall rules to detect and block common path traversal attack patterns

Monitoring Recommendations

Continuously monitor FortiWeb management interface access logs for suspicious authentication attempts and administrative command execution
Implement network segmentation monitoring to detect lateral movement following potential FortiWeb compromise
Configure SIEM alerts for unusual administrative activity patterns on FortiWeb appliances
Review FortiWeb configuration changes regularly to detect unauthorized modifications

How to Mitigate CVE-2025-64446

Immediate Actions Required

Apply the latest security patches from Fortinet immediately to all affected FortiWeb installations
Restrict network access to FortiWeb management interfaces to trusted IP addresses only
Monitor FortiWeb devices for indicators of compromise and review recent access logs for suspicious activity
Consider temporarily disabling external access to FortiWeb management interfaces until patches are applied

Patch Information

Fortinet has released security patches to address this vulnerability. Organizations should consult the Fortinet Security Advisory FG-IR-25-910 for specific patch versions and upgrade instructions. Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies are required to remediate within mandated timeframes, and all organizations should prioritize patching.

Workarounds

Implement strict network access control lists (ACLs) to limit management interface access to authorized administrators only
Place FortiWeb management interfaces behind a VPN or jump server to reduce direct exposure
Enable multi-factor authentication for administrative access where supported
Monitor and alert on any access attempts to FortiWeb management interfaces from untrusted networks

bash

# Example: Restrict management access to specific trusted IP ranges
# Implement firewall rules to limit access to FortiWeb management interface
# Consult Fortinet documentation for specific configuration commands
# Reference: https://fortiguard.fortinet.com/psirt/FG-IR-25-910