Critical · published November 14, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A crafty attacker can execute administrative commands on your Fortinet FortiWeb with just a cleverly crafted HTTP request! 🔥 Think of it like a delivery service that blindly follows a poorly written address, allowing anyone to receive sensitive packages instead of the intended recipient. This vulnerability lets an attacker navigate through directories and access restricted areas without proper authentication. The implications are absolutely devastating! An attacker can gain full control over your system, modifying settings, accessing confidential data, and potentially turning your security solution into a liability. This could lead to a complete compromise of your website and data integrity.
Think of it like a delivery service that blindly follows a poorly written address, allowing anyone to receive sensitive packages instead of the intended recipient. This vulnerability lets an attacker navigate through directories and access restricted areas without proper authentication. This vulnerability is caused by a relative path traversal flaw in Fortinet FortiWeb versions 8.0.0 through 8.0.1, and 7.x versions down to 7.0.0 through 7.0.11. It allows attackers to manipulate crafted HTTP or HTTPS requests to execute administrative commands on the vulnerable system.
The implications are absolutely devastating! An attacker can gain full control over your system, modifying settings, accessing confidential data, and potentially turning your security solution into a liability. This could lead to a complete compromise of your website and data integrity. To protect your systems, immediately patch Fortinet FortiWeb to version 8.0.2 or later, and ensure all prior versions from 7.x are updated to a safe version. Additionally, review your access controls and request validation to prevent similar exploits in the future. You've got this! Follow these steps, and you'll have your defenses fortified in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/fortiweb | ≥ 7.0.0, < 7.0.12 | 7.0.12 |
| fortinet/fortiweb | ≥ 7.2.0, < 7.2.12 | 7.2.12 |
| fortinet/fortiweb | ≥ 7.4.0, < 7.4.10 | 7.4.10 |
| fortinet/fortiweb | ≥ 7.6.0, < 7.6.5 | 7.6.5 |
| fortinet/fortiweb | ≥ 8.0.0, < 8.0.2 | 8.0.2 |