---
id: "CVE-2025-61625"
page: "https://infrastack.ai/live/CVE-2025-61625"
kind: "vulnerability"
aliases: ["CVE-2025-61625"]
title: "Fortinet FortiAnalyzer and FortiManager: read-only users can write and delete files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["no-untrusted-read-only-accounts", "versions-outside-range"]
published_at: "2026-11-10T20:17:20+00:00"
first_seen_at: "2026-11-10T20:46:00+00:00"
updated_at: "2026-11-10T20:47:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61625", "first_seen_at": "2026-11-10T20:46:00+00:00"}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: read-only users can write and delete files

Link for people: https://infrastack.ai/live/CVE-2025-61625 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager have a path traversal flaw that lets an authenticated user with read-only permission write and delete files on the underlying filesystem through crafted HTTP or HTTPS requests. An attacker who already holds a low-privilege login can change or remove system files, which may lead to full control of the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiAnalyzer or FortiManager version in the admin GUI or with `get system status`, and compare it to the affected ranges: 7.6.0 to 7.6.4, 7.4.0 to 7.4.7, 7.2.0 to 7.2.11 (FortiManager Cloud 7.2.1 to 7.2.10 and 7.4.1 to 7.4.7 also listed).
- Review which accounts hold read-only administrator profiles.

## Fix

- FortiAnalyzer and FortiManager: move to a release outside the affected ranges listed by the source (fixed versions not named in the source).

## Timeline

- 2026-11-10T20:46:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-61625

## From the sources

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_