CVE-2025-64446

FortiWeb has a path traversal flaw that lets attackers bypass security restrictions and run admin commands on the system by sending specially crafted web requests. This is critical because it gives attackers full control over the web application firewall.

A relative path traversal vulnerability (CWE-23) in affected FortiWeb versions allows unauthenticated or low-privileged attackers to manipulate file paths in HTTP/HTTPS requests to access restricted administrative functions and execute arbitrary commands with elevated privileges. The vulnerability affects versions 7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, and 8.0.0-8.0.1, with attack vector over the network requiring no user interaction.