CVE-2025-54822: Improper autorization over static files
An improper authorization vulnerability [CWE-285] in FortiOS & FortiProxy may allow an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.
Other sources
An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54822?
The severity of CVE-2025-54822 is critical due to its potential to allow authenticated attackers to access unauthorized data.
How do I fix CVE-2025-54822?
To fix CVE-2025-54822, upgrade Fortinet FortiOS to version 7.4.2 or higher, or FortiProxy to version 7.4.9 or higher.
Which versions are affected by CVE-2025-54822?
CVE-2025-54822 affects Fortinet FortiOS versions 7.4.0 to 7.4.1 and prior to 7.2.8, as well as Fortinet FortiProxy versions before 7.4.8.
Can CVE-2025-54822 be exploited remotely?
Yes, CVE-2025-54822 can be exploited remotely, allowing attackers to send crafted HTTP or HTTPS requests.
What type of vulnerability is CVE-2025-54822?
CVE-2025-54822 is categorized as an improper authorization vulnerability, specifically labeled as CWE-285.