{"id":"CVE-2025-64446","kind":"vulnerability","aliases":["CVE-2025-64446"],"related":[],"title":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4,…","description":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Fortinet FortiWeb, a web application firewall appliance, has a relative path traversal flaw that lets crafted HTTP or HTTPS requests reach administrative functions. An unauthenticated attacker can run administrative commands on the device, and CISA lists it as exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-11-14T00:00:00+00:00","products":[{"name":"fortinet fortiweb","fixed":["7.0.12"],"affected":">= 7.0.0, < 7.0.12","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.2.12"],"affected":">= 7.2.0, < 7.2.12","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.4.10"],"affected":">= 7.4.0, < 7.4.10","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.6.5"],"affected":">= 7.6.0, < 7.6.5","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["8.0.2"],"affected":">= 8.0.0, < 8.0.2","ecosystem":"vendor"},{"name":"Fortinet FortiWeb","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortinet","fortiweb","infrastructure","self-hosted","waf"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations in the vendor instructions referenced by CISA; the sources do not name a fixed version. If mitigations are unavailable, discontinue use of the product per CISA guidance.","status":"open","published_at":"2025-11-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:21+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:44:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in the vendor instructions referenced by CISA; the sources do not name a fixed version. If mitigations are unavailable, discontinue use of the product per CISA guidance.","reach":"internet","summary":"Fortinet FortiWeb, a web application firewall appliance, has a relative path traversal flaw that lets crafted HTTP or HTTPS requests reach administrative functions. An unauthenticated attacker can run administrative commands on the device, and CISA lists it as exploited in the wild.","category":"infrastructure","who_cares":["fortiweb","fortinet","self-hosted","waf"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs administrative commands on the FortiWeb appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-64446 to get affected and fixed versions and the exact mitigation steps, and check the CISA KEV entry for the due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000461,"input_tokens":2551,"output_tokens":412,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':123C '-2025':17A,20A '-64446':18A,21A '22':122C '7.6.0':13A '7.6.4':15A '8.0.0':9A '8.0.1':11A 'action':113C 'administr':63B,70B,100C 'allow':94C 'appli':114C 'applianc':48B 'applic':46B,120C 'attack':67B,97C 'bod':121C 'cisa':76B,111C 'cloud':126C 'command':71B,101C 'contain':86C 'craft':57B,106C 'cve':16A,19A 'devic':74B 'discontinu':129C 'execut':99C 'exploit':34B,80B 'firewal':47B 'flaw':54B 'follow':119C 'fortinet':7A,22A,24A,26A,28A,30A,32A,35B,42B,84C 'fortiweb':8A,12A,23A,25A,27A,29A,31A,33A,36B,43B,85C 'function':64B 'guidanc':124C 'host':40B 'http':58B,107C 'https':60B,109C 'infrastructur':37B 'instruct':118C 'let':56B 'list':77B 'may':93C 'mitig':115C,135C 'path':3A,52B,89C 'per':116C 'product':133C 'reach':62B 'relat':2A,51B,88C 'request':61B,110C 'requir':112C 'run':69B 'self':39B 'self-host':38B 'servic':127C 'system':104C 'travers':4A,53B,90C 'unauthent':66B,96C 'unavail':137C 'use':130C 'vendor':117C 'via':105C 'vulner':5A,91C 'waf':41B 'web':45B 'wild':83B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-14T00:00:00+00:00","kev":{"dateAdded":"2025-11-14","dueDate":"2025-11-21","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-64446","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-64446","severity":null,"published_at":"2025-11-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-64446","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64446","severity":null,"published_at":"2025-11-14T16:15:58+00:00","modified_at":"2026-10-18T20:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}