CyberCVE

CVE-2025-53609

A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbi

Severity
Medium 4.7
CVSS 3.1
Remote, needs privileges or user interaction what this means
Exploited
Not listed
EPSS
0.093
95.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Sep 9, 2025
Assigned by fortinet

Description

A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.

Weakness: CWE-23

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Check your version Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Jason McFadyen from Trend Research of Trend Micro for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiWeb version 8.0.0 or above Upgrade to FortiWeb version 7.6.5 or above Upgrade to FortiWeb version 7.4.9 or above Upgrade to FortiWeb version 7.2.12 or above

References

Something wrong here?