Path traversal in Fortinet, Inc products - CVE-2025-61624
Published: April 14, 2026 / Updated: June 16, 2026
Vulnerability identifier: #VU126001
CSH Severity: High
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-61624
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local privileged user to damange or delete data.
The vulnerability exists due to improper limitation of a pathname to a restricted directory ('path traversal') in CLI. A privileged attacker can achieve arbitrary write or delete files via specifically crafted arguments to existing commands.
Affected software
FortiPAM
FortiOS
FortiProxy
FortiSwitch Manager
FortiOS
FortiProxy
FortiSwitch Manager
How to mitigate CVE-2025-61624
Install update from vendor's website.
FortiPAM - update to 1.7.1
FortiOS - addressed in versions 7.4.10, 7.6.5
FortiProxy - addressed in versions 7.4.12, 7.6.5
FortiSwitch Manager - addressed in versions 7.0.7, 7.2.8
FortiOS - addressed in versions 7.4.10, 7.6.5
FortiProxy - addressed in versions 7.4.12, 7.6.5
FortiSwitch Manager - addressed in versions 7.0.7, 7.2.8