CVE-2025-58693
published 2026-01-13CVE-2025-58693: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0…
PriorityP341medium6.5CVSS 3.1
AVNACLPRHUINSUCNIHAH
EPSS
0.60%
44.7th percentile
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortivoice | — | — |
| fortinet | fortivoice | >= 7.0.0 < 7.0.8 | 7.0.8 |
| fortinet | fortivoice | 7.0.0 – 7.0.7 | — |
| fortinet | fortivoice | >= 7.2.0 < 7.2.3 | 7.2.3 |
| fortinet | fortivoice | 7.2.0 – 7.2.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2397-gxj5-7465: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7
ghsa_unreviewed·2026-01-13
CVE-2025-58693 [MEDIUM] CWE-22 GHSA-2397-gxj5-7465: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Fortinet
Arbitrary file deletion in administrative interface
vendor_fortinet·2026-01-13·CVSS 6.5
CVE-2025-58693 [MEDIUM] CWE-22 Arbitrary file deletion in administrative interface
FG-IR-25-778: Arbitrary file deletion in administrative interface
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
CVEs: CVE-2025-58693
CWEs: CWE-22
CVSS: 6.5 (medium)
Affected products: FortiVoice, Fortinet
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-01-13
Published