CVE-2025-68649
Description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.7, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
How to fix
- fortinet fortimanager_cloud7.4.8, 7.6.5 or later
- fortinet fortimanager7.4.8, 7.6.5 or later
- fortinet fortianalyzer_cloud7.4.8, 7.6.5 or later
- fortinet fortianalyzer7.4.8, 7.6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortimanager_cloud | 7.0.0 ≤ v < 7.4.8, 7.6.0 ≤ v < 7.6.5 | 7.4.8, 7.6.5 |
| fortinet fortimanager | 7.0.0 ≤ v < 7.4.8, 7.6.0 ≤ v < 7.6.5 | 7.4.8, 7.6.5 |
| fortinet fortianalyzer_cloud | 7.0.0 ≤ v < 7.4.8, 7.6.0 ≤ v < 7.6.5 | 7.4.8, 7.6.5 |
| fortinet fortianalyzer | 7.0.0 ≤ v < 7.4.8, 7.6.0 ≤ v < 7.6.5 | 7.4.8, 7.6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.