{"id":"CVE-2025-61625","kind":"vulnerability","aliases":["CVE-2025-61625"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: read-only users can write and delete files","description":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.","summary":"Fortinet FortiAnalyzer and FortiManager have a path traversal flaw that lets an authenticated user with read-only permission write and delete files on the underlying filesystem through crafted HTTP or HTTPS requests. An attacker who already holds a low-privilege login can change or remove system files, which may lead to full control of the appliance.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["no-untrusted-read-only-accounts","versions-outside-range"],"how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin GUI or with `get system status`, and compare it to the affected ranges: 7.6.0 to 7.6.4, 7.4.0 to 7.4.7, 7.2.0 to 7.2.11 (FortiManager Cloud 7.2.1 to 7.2.10 and 7.4.1 to 7.4.7 also listed).\n- Review which accounts hold read-only administrator profiles.","fix":"- FortiAnalyzer and FortiManager: move to a release outside the affected ranges listed by the source (fixed versions not named in the source).","status":"open","published_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","triaged_at":"2026-11-10T20:47:40+00:00","updated_at":"2026-11-10T20:47:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:47:40Z","model":"claude-haiku-5-5","output":{"fix":"- FortiAnalyzer and FortiManager: move to a release outside the affected ranges listed by the source (fixed versions not named in the source).","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: read-only users can write and delete files","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager have a path traversal flaw that lets an authenticated user with read-only permission write and delete files on the underlying filesystem through crafted HTTP or HTTPS requests. An attacker who already holds a low-privilege login can change or remove system files, which may lead to full control of the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker writes and deletes system files, possibly taking over the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-61625 to confirm fixed versions and any workaround.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin GUI or with `get system status`, and compare it to the affected ranges: 7.6.0 to 7.6.4, 7.4.0 to 7.4.7, 7.2.0 to 7.2.11 (FortiManager Cloud 7.2.1 to 7.2.10 and 7.4.1 to 7.4.7 also listed).\n- Review which accounts hold read-only administrator profiles.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-range","no-untrusted-read-only-accounts"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or FortiManager Cloud) in the listed version ranges. The attacker needs an authenticated account with read-only permission, so exposure depends on who holds such accounts.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000837,"input_tokens":4744,"output_tokens":725,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-61625':16A,19A '7.2.0':109C,121C '7.2.1':136C '7.2.10':138C '7.2.11':111C,123C '7.4.0':105C,117C '7.4.1':131C '7.4.7':107C,119C,133C '7.6.0':101C,113C,126C '7.6.4':103C,115C,128C 'allow':140C 'alreadi':63B 'applianc':84B 'attack':61B,143C 'authent':39B,142C 'chang':71B 'cloud':125C,130C,135C 'control':81B 'craft':55B,160C 'cve':14A,17A 'delet':12A,48B,153C 'directori':94C 'file':13A,49B,75B,154C 'filesystem':53B,158C 'flaw':35B 'fortianalyz':2A,20B,28B,100C,104C,108C 'fortimanag':4A,21B,30B,112C,116C,120C,124C,129C,134C 'fortinet':1A,22B,27B,99C 'full':80B 'hold':64B 'host':26B 'http':56B,161C 'https':58B,163C 'improp':86C 'infrastructur':23B 'lead':78B 'let':37B 'limit':87C 'login':69B 'low':67B 'low-privileg':66B 'may':77B,139C 'path':33B,95C 'pathnam':90C 'permiss':45B,149C 'privileg':68B 'profil':145C 'read':6A,43B,148C 'read-on':5A,42B 'remov':73B 'request':59B,164C 'restrict':93C 'self':25B 'self-host':24B 'system':74B 'travers':34B,96C 'under':52B,157C 'user':8A,40B 'via':159C 'vulner':97C 'whose':144C 'write':10A,46B,151C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or FortiManager Cloud) in the listed version ranges. The attacker needs an authenticated account with read-only permission, so exposure depends on who holds such accounts.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-2025':15A,18A '-61625':16A,19A 'cve':14A,17A 'delet':12A 'file':13A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'read':6A 'read-on':5A 'user':8A 'write':10A","search_b":"'alreadi':63B 'applianc':84B 'attack':61B 'authent':39B 'chang':71B 'control':81B 'craft':55B 'delet':48B 'file':49B,75B 'filesystem':53B 'flaw':35B 'fortianalyz':20B,28B 'fortimanag':21B,30B 'fortinet':22B,27B 'full':80B 'hold':64B 'host':26B 'http':56B 'https':58B 'infrastructur':23B 'lead':78B 'let':37B 'login':69B 'low':67B 'low-privileg':66B 'may':77B 'path':33B 'permiss':45B 'privileg':68B 'read':43B 'read-on':42B 'remov':73B 'request':59B 'self':25B 'self-host':24B 'system':74B 'travers':34B 'under':52B 'user':40B 'write':46B","search_c":"'7.2.0':109C,121C '7.2.1':136C '7.2.10':138C '7.2.11':111C,123C '7.4.0':105C,117C '7.4.1':131C '7.4.7':107C,119C,133C '7.6.0':101C,113C,126C '7.6.4':103C,115C,128C 'allow':140C 'attack':143C 'authent':142C 'cloud':125C,130C,135C 'craft':160C 'delet':153C 'directori':94C 'file':154C 'filesystem':158C 'fortianalyz':100C,104C,108C 'fortimanag':112C,116C,120C,124C,129C,134C 'fortinet':99C 'http':161C 'https':163C 'improp':86C 'limit':87C 'may':139C 'path':95C 'pathnam':90C 'permiss':149C 'profil':145C 'read':148C 'request':164C 'restrict':93C 'travers':96C 'under':157C 'via':159C 'vulner':97C 'whose':144C 'write':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-61625","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61625","severity":null,"published_at":"2026-11-10T20:17:20+00:00","modified_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","fetched_at":"2026-11-10T20:46:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}