CVE-2025-68649 — Path Traversal in Fortinet Fortianalyzer

CWE-22 — Path Traversal4 documents4 sources
Severity
6.0MEDIUMNVD
EPSS
0.0%
top 88.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Fortinet FortianalyzerFortinet Fortianalyzer CloudFortinet Fortimanager+1 more
Timeline
PublishedApr 14

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, F…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HExploitability: 0.8 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5fortinet/fortimanager_cloud7.6.2 — 7.6.4+3
▶CVEListV5fortinet/fortianalyzer_cloud7.4.1 — 7.4.7+3
▶CVEListV5fortinet/fortimanager7.6.0 — 7.6.4+3
▶CVEListV5fortinet/fortianalyzer7.6.0 — 7.6.4+3

🔴Vulnerability Details

2
GHSA
GHSA-w5r2-jfhj-qppp: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7↗2026-04-14
▶
CVEList
CVE-2025-68649: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7↗2026-04-14
▶

📋Vendor Advisories

1
Fortinet
Path Traversal in CLI↗2026-04-14
▶
CVE-2025-68649 — Path Traversal in Fortinet | cvebase