CVE-2025-68649: Path Traversal in CLI
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
Other sources
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.7, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68649?
CVE-2025-68649 is classified as a high severity vulnerability allowing for path traversal and potential file deletion.
How do I fix CVE-2025-68649?
To mitigate CVE-2025-68649, upgrade FortiAnalyzer and FortiManager products to version 7.6.5 or later, or 7.4.8 for earlier versions.
Which Fortinet products are affected by CVE-2025-68649?
CVE-2025-68649 affects FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud across multiple versions.
Can CVE-2025-68649 be exploited remotely?
Yes, CVE-2025-68649 can be exploited remotely by a privileged attacker through crafted CLI requests.
What types of attacks can CVE-2025-68649 facilitate?
CVE-2025-68649 can facilitate attacks that allow privileged users to delete files from the underlying filesystem.