Intelligence online17 sources monitored17 actively exploited 7d30 published 24hChecked recently
Vulnerability record

CVE-2025-61624

ElevatedNo known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
FortiGate / FortiOSFortinet>= 6.4.0, < 7.4.10; >= 7.6.0, < 7.6.5; >= 7.0.0, < 7.4.127.4.10; 7.6.5; 7.4.12NVD

Sources: NVD = NIST National Vulnerability Database.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdate

    CVE-2025-61624 scored CVSS 6.5

    Basis: NIST National Vulnerability Database

Coverage

We have not published a story about this vulnerability yet.

References