CVE-2025-53609

A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - psirt@fortinet.com

Published

2025-09-09

Last modified

2026-01-14

Weaknesses

CWE-23

Affected products

• Fortiweb (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-512