CVE-2025-61625: Arbitrary file write and delete in JSON API

Q: Which deployments are affected?

Affected releases are FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11; FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11; and FortiManager Cloud 7.6.0 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.10.

Q: What access does an attacker need to exploit this issue?

An attacker must be authenticated to the API, but a profile with only read permission is sufficient. Exploitation is performed through crafted HTTP or HTTPS requests.

Q: What is the impact of successful exploitation?

A successful attacker can write and delete files on the underlying filesystem. The provided information does not indicate that confidentiality is affected.

Published Nov 10, 2026

Updated

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

Other sources

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

— MITRE

Affected Software

9 affected componentsFixes available

Fortinet FortiAnalyzer>=7.6.0<=7.6.4

Fortinet FortiAnalyzer>=7.4.0<=7.4.7

Fortinet FortiAnalyzer>=7.2.0<=7.2.11

Fortinet FortiManager>=7.6.0<=7.6.4

Fortinet FortiManager>=7.4.0<=7.4.7

Fortinet FortiManager>=7.2.0<=7.2.11

Fortinet FortiManager Cloud>=7.6.0<=7.6.4

Fortinet FortiManager Cloud>=7.4.1<=7.4.7

Fortinet FortiManager Cloud>=7.2.1<=7.2.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.12
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.8
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.6.5
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.2.11
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.4.8
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.6.5
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.5

Event History

Nov 10, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected releases are FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11; FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11; and FortiManager Cloud 7.6.0 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.10.

What access does an attacker need to exploit this issue?

An attacker must be authenticated to the API, but a profile with only read permission is sufficient. Exploitation is performed through crafted HTTP or HTTPS requests.

What is the impact of successful exploitation?

A successful attacker can write and delete files on the underlying filesystem. The provided information does not indicate that confidentiality is affected.

CVE-2025-61625: Arbitrary file write and delete in JSON API

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?