---
id: CVE-2025-61624
title: >-
  An Improper Limitation of a Pathname to a Restricted Directory ('Path
  Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,
  FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.…
summary: >-
  An Improper Limitation of a Pathname to a Restricted Directory ('Path
  Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,
  FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.…
severity: medium
cvss: 6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
vendor: fortinet
product: fortiproxy
affected:
  - 'fortios >= 6.4.0, < 7.4.10'
  - 'fortios >= 7.6.0, < 7.6.5'
  - 'fortipam >= 1.0.0, < 1.7.1'
  - 'fortiproxy >= 7.0.0, < 7.4.12'
  - 'fortiproxy >= 7.6.0, < 7.6.5'
  - 'fortiswitchmanager >= 7.0.0, < 7.0.7'
  - 'fortiswitchmanager >= 7.2.0, < 7.2.8'
  - ruggedcom_ape1808_firmware
patched:
  - fortios 7.6.5
  - fortipam 1.7.1
  - fortiproxy 7.6.5
  - fortiswitchmanager 7.2.8
published: '2026-04-14'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T04:16:43.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61624'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-122'
    label: psirt@fortinet.com
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-975644.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - cve.org
  - exploit-available
epss: 0.01343
epssPercentile: 0.71211
kev: true
kevDateAdded: '2026-10-16'
kevDueDate: '2026-10-19'
kevRansomware: false
exploited: true
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T17:50:10.589935Z'
scores:
  nvd: 6
  cna: 5.4
ingestedAt: '2026-10-14T13:30:58.479Z'
---

## Overview

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

## Affected

- `fortios >= 6.4.0, < 7.4.10`
- `fortios >= 7.6.0, < 7.6.5`
- `fortipam >= 1.0.0, < 1.7.1`
- `fortiproxy >= 7.0.0, < 7.4.12`
- `fortiproxy >= 7.6.0, < 7.6.5`
- `fortiswitchmanager >= 7.0.0, < 7.0.7`
- `fortiswitchmanager >= 7.2.0, < 7.2.8`
- `ruggedcom_ape1808_firmware`

## Remediation

Upgrade past the affected range:

- `fortios 7.6.5`
- `fortipam 1.7.1`
- `fortiproxy 7.6.5`
- `fortiswitchmanager 7.2.8`