---
id: "CVE-2025-61624"
kind: "vulnerability"
aliases: ["CVE-2025-61624"]
title: "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet\u2026"
severity: "high"
cvss: 6.5
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "FortiOS", "fixed": ["7.4.10", "7.6.5"], "affected": "6.4 all, 7.0 all, 7.2 all, 7.4.0 - 7.4.9, 7.6.0 - 7.6.4", "ecosystem": "vendor"}, {"name": "FortiPAM", "fixed": ["1.7.1"], "affected": "1.0 - 1.6 all, 1.7.0", "ecosystem": "vendor"}, {"name": "FortiProxy", "fixed": ["7.4.12", "7.6.5"], "affected": "7.0 all, 7.2 all, 7.4.0 - 7.4.11, 7.6.0 - 7.6.4", "ecosystem": "vendor"}, {"name": "FortiSwitchManager", "fixed": ["7.0.7", "7.2.8"], "affected": "7.0.0 - 7.0.6, 7.2.0 - 7.2.7", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.4.10"], "affected": ">= 6.4.0, < 7.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.6.5"], "affected": ">= 7.6.0, < 7.6.5", "ecosystem": "vendor"}, {"name": "fortinet fortipam", "fixed": ["1.7.1"], "affected": ">= 1.0.0, < 1.7.1", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.4.12"], "affected": ">= 7.0.0, < 7.4.12", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.6.5"], "affected": ">= 7.6.0, < 7.6.5", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": ["7.0.7"], "affected": ">= 7.0.0, < 7.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": ["7.2.8"], "affected": ">= 7.2.0, < 7.2.8", "ecosystem": "vendor"}, {"name": "siemens ruggedcom ape1808 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortigate", "fortios", "fortipam", "fortiproxy", "fortiswitchmanager", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-04-14T16:16:31+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:33:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet…

FortiOS, FortiPAM, FortiProxy and FortiSwitchManager have a path traversal flaw in specific CLI commands. An authenticated admin with read-write permissions can write or delete arbitrary files on the device, and the flaw is exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortinet Multiple Products affected ? fixed ?
- vendor:FortiOS affected 6.4 all, 7.0 all, 7.2 all, 7.4.0 - 7.4.9, 7.6.0 - 7.6.4 fixed 7.4.10, 7.6.5
- vendor:FortiPAM affected 1.0 - 1.6 all, 1.7.0 fixed 1.7.1
- vendor:FortiProxy affected 7.0 all, 7.2 all, 7.4.0 - 7.4.11, 7.6.0 - 7.6.4 fixed 7.4.12, 7.6.5
- vendor:FortiSwitchManager affected 7.0.0 - 7.0.6, 7.2.0 - 7.2.7 fixed 7.0.7, 7.2.8
- vendor:fortinet fortios affected >= 6.4.0, < 7.4.10 fixed 7.4.10
- vendor:fortinet fortios affected >= 7.6.0, < 7.6.5 fixed 7.6.5
- vendor:fortinet fortipam affected >= 1.0.0, < 1.7.1 fixed 1.7.1
- vendor:fortinet fortiproxy affected >= 7.0.0, < 7.4.12 fixed 7.4.12
- vendor:fortinet fortiproxy affected >= 7.6.0, < 7.6.5 fixed 7.6.5
- vendor:fortinet fortiswitchmanager affected >= 7.0.0, < 7.0.7 fixed 7.0.7
- vendor:fortinet fortiswitchmanager affected >= 7.2.0, < 7.2.8 fixed 7.2.8
- vendor:siemens ruggedcom ape1808 firmware affected ? fixed ?

## How to check

Compare the running firmware version with the affected ranges listed in the sources (FortiOS 7.4.0-7.4.9 and 7.6.0-7.6.4; FortiProxy 7.4.0-7.4.11 and 7.6.0-7.6.4; FortiPAM 1.7.0; FortiSwitchManager 7.0.0-7.0.6 and 7.2.0-7.2.7). Review admin accounts for profiles with read-write rights.

## Fix

Upgrade to FortiOS 7.4.10 or 7.6.5, FortiProxy 7.4.12 or 7.6.5, FortiPAM 1.7.1, or FortiSwitchManager 7.0.7 or 7.2.8, per Fortinet PSIRT FG-IR-26-122. Follow the CISA BOD 26-04 guidance for devices where patching is not possible.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624
- 2026-10-23T21:33:58+00:00 analyst — Read Fortinet PSIRT FG-IR-26-122 (published 2026-04-14, Medium CVSS 6.0, known exploited) for versions; Unit 42 reports exploitation as a zero-day by CL-STA-0954/UNC5820 to deploy PEERSTITCH after a FortiManager compromise. No public PoC found. Severity kept at high because of KEV listing and exploitation.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-61624

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-122 (CVE-2025-61624) https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- [describes] NVD CVE-2025-61624 https://nvd.nist.gov/vuln/detail/CVE-2025-61624
- [describes] Unit 42: PEERSTITCH, a stealthy FortiGate implant https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
- [discussion] https://x.com/zoomeyebot/status/2113325851958038955 https://x.com/zoomeyebot/status/2113325851958038955
- [fix] Fortinet PSIRT FG-IR-26-122 (CVE-2025-61624) https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- [mentions] The Hacker News: PEERSTITCH deployed via FortiOS flaw https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html

## From the sources

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_