CVE-2024-40588: Path Traversal

Q: What is the severity of CVE-2024-40588?

CVE-2024-40588 is considered a high-severity vulnerability due to its potential for exploitation through path traversal.

Q: How do I fix CVE-2024-40588?

To fix CVE-2024-40588, upgrade affected Fortinet products to the latest versions that are not impacted by the vulnerability.

Q: Which versions are affected by CVE-2024-40588?

CVE-2024-40588 affects FortiMail versions 7.6.0 through 7.6.1 and versions before 7.4.3, FortiVoice versions 7.0.0 through 7.0.5 and before 7.4.9, FortiRecorder versions 7.2.0 through 7.2.1 and before 7.0.4, and FortiCamera & FortiNDR versions before 7.4.6.

Q: What kind of vulnerability is CVE-2024-40588?

CVE-2024-40588 is a multiple relative path traversal vulnerability classified under CWE-23.

Q: What products are impacted by CVE-2024-40588?

CVE-2024-40588 impacts Fortinet products including FortiMail, FortiVoice, FortiRecorder, FortiCamera, and FortiNDR.

Published Aug 12, 2025

Updated

Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0 all versions, FortiMail 7.6.0 through 7.6.1, FortiMail 7.4.0 through 7.4.3, FortiMail 7.2 all versions, FortiMail 7.0 all versions, FortiMail 6.4 all versions, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.6, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiRecorder 6.4 all versions, FortiVoice 7.0.0 through 7.0.3, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests.

Affected Software

15 affected components

Fortinet FortiMail>=7.6.0<=7.6.1, <7.4.3

Fortinet FortiVoice>=7.0.0<=7.0.5, <7.4.9

Fortinet FortiRecorder>=7.2.0<=7.2.1, <7.0.4

Fortinet FortiCamera<7.4.6

Fortinet FortiNDR<7.4.6

All of the following

Fortinet Forticamera Firmware>=2.0.0<=2.1.4

Fortinet FortiCamera

Fortinet FortiMail>=6.4.0<7.4.4

Fortinet FortiMail>=7.6.0<7.6.2

Fortinet FortiNDR>=7.0.0<7.4.7

Fortinet FortiNDR>=7.6.0<7.6.2

Fortinet FortiRecorder>=6.4.0<7.0.5

Fortinet FortiRecorder>=7.2.0<7.2.2

Fortinet FortiVoice>=6.0.0<6.4.10

Fortinet FortiVoice>=7.0.0<7.0.5

Remediation

Information

Upgrade to upcoming FortiCamera version 2.0.1 or above Upgrade to FortiNDR version 7.6.2 or above Upgrade to FortiNDR version 7.4.7 or above Upgrade to FortiMail version 7.6.2 or above Upgrade to FortiMail version 7.4.4 or above Upgrade to FortiRecorder version 7.2.2 or above Upgrade to FortiRecorder version 7.0.5 or above Upgrade to FortiFone version 3.0.24 or above Upgrade to FortiVoice version 7.2.0 or above Upgrade to FortiVoice version 7.0.5 or above Upgrade to FortiVoice version 6.4.10 or above

Event History

Aug 12, 2025

CVE Published

via MITRE·06:59 PM

Data Sourced

via MITRE·06:59 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-40588?

CVE-2024-40588 is considered a high-severity vulnerability due to its potential for exploitation through path traversal.

How do I fix CVE-2024-40588?

To fix CVE-2024-40588, upgrade affected Fortinet products to the latest versions that are not impacted by the vulnerability.

Which versions are affected by CVE-2024-40588?