---
id: CVE-2025-61624
title: >-
  An Improper Limitation of a Pathname to a Restricted Directory ('Path
  Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,
  FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.…
summary: >-
  An Improper Limitation of a Pathname to a Restricted Directory ('Path
  Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,
  FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.…
severity: medium
cvss: 6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
vendor: fortinet
product: fortiproxy
affected:
  - 'fortios >= 6.4.0, < 7.4.10'
  - 'fortios >= 7.6.0, < 7.6.5'
  - 'fortipam >= 1.0.0, < 1.7.1'
  - 'fortiproxy >= 7.0.0, < 7.4.12'
  - 'fortiproxy >= 7.6.0, < 7.6.5'
  - 'fortiswitchmanager >= 7.0.0, < 7.0.7'
  - 'fortiswitchmanager >= 7.2.0, < 7.2.8'
patched:
  - fortios 7.6.5
  - fortipam 1.7.1
  - fortiproxy 7.6.5
  - fortiswitchmanager 7.2.8
published: '2026-04-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61624'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-122'
    label: psirt@fortinet.com
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-975644.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00498
epssPercentile: 0.41036
ingestedAt: '2026-10-14T13:30:58.479Z'
---

## Overview

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

## Affected

- `fortios >= 6.4.0, < 7.4.10`
- `fortios >= 7.6.0, < 7.6.5`
- `fortipam >= 1.0.0, < 1.7.1`
- `fortiproxy >= 7.0.0, < 7.4.12`
- `fortiproxy >= 7.6.0, < 7.6.5`
- `fortiswitchmanager >= 7.0.0, < 7.0.7`
- `fortiswitchmanager >= 7.2.0, < 7.2.8`

## Remediation

Upgrade past the affected range:

- `fortios 7.6.5`
- `fortipam 1.7.1`
- `fortiproxy 7.6.5`
- `fortiswitchmanager 7.2.8`