CVE-2025-64446: FortiWeb Path Traversal Command Execution

Source-specific exposure conditions

• FortiWeb versions 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, or 8.0.0 through 8.0.1 are deployed.
• The FortiWeb HTTP or HTTPS management interface is exposed to the internet or another untrusted network.
• An attacker can send crafted HTTP or HTTPS requests to the affected GUI component without authentication.

Source-specific remediation

• Upgrade FortiWeb 7.0 deployments to 7.0.12 or later.
• Upgrade FortiWeb 7.2 deployments to 7.2.12 or later.
• Upgrade FortiWeb 7.4 deployments to 7.4.10 or later.
• Upgrade FortiWeb 7.6 deployments to 7.6.5 or later.
• Upgrade FortiWeb 8.0 deployments to 8.0.2 or later.
• Until upgrading is complete, disable HTTP and HTTPS access on internet-facing interfaces. If management access is restricted to internal networks, maintain that restriction and further limit access to trusted administration networks.
• Review the FortiWeb configuration and logs for unexpected modifications or unauthorized administrator accounts, particularly where an affected version was internet-accessible.

Source-specific verification

• Confirm the running FortiWeb version is at or above the applicable fixed version for its release branch.
• Confirm HTTP and HTTPS management access is not enabled on internet-facing interfaces, unless the deployment has been upgraded to a fixed version.
• Review configuration and audit logs for unexpected changes or newly added administrator accounts, and investigate anomalies.
• For FortiWeb 6.4 deployments, record that Fortinet identifies the branch as not affected; continue applying normal vendor-supported update practices.

Uncertainty and evidence gaps

• The supplied record identifies a generic software/application ecosystem; authoritative sources narrow the affected product to Fortinet FortiWeb and do not establish impact to unrelated products.
• Fortinet's advisory states that FortiAppSec Cloud is not impacted; this enrichment does not infer impact to other Fortinet cloud services or deployment models.
• The sources establish version-based remediation and configuration review, but do not provide a non-invasive runtime test that can conclusively prove absence of compromise.

Claim-to-source evidence

• Affected Product: CVE-2025-64446 affects Fortinet FortiWeb and is a relative path traversal vulnerability in the GUI component. Evidence
• Affected Version: Affected versions are FortiWeb 7.0.0–7.0.11, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.4, and 8.0.0–8.0.1. Evidence
• Exposure: An unauthenticated attacker may exploit the issue through crafted HTTP or HTTPS requests; internet-facing HTTP or HTTPS management interfaces increase exposure. Evidence
• Fixed Version: Fortinet identifies fixed versions as 7.0.12, 7.2.12, 7.4.10, 7.6.5, and 8.0.2 respectively, or later within each release branch. Evidence
• Remediation: Fortinet recommends disabling HTTP or HTTPS on internet-facing interfaces until an upgrade can be performed. Evidence
• Verification: Fortinet recommends reviewing configuration and logs for unexpected modifications or unauthorized administrator accounts after upgrading. Evidence
• Affected Product: NVD records the vulnerability as affecting Fortinet FortiWeb and classifies it as CWE-23 with a CNA CVSS 3.1 score of 9.8 Critical. Evidence

Synthesis sources

• fortiguard.fortinet.com
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-15T11:18:55Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

3863d50398bc2503703aa6e779f4249bf8ff3c908e65a96bdf828eda6b77a05c

Recorded gaps

• generic_ecosystem