CVE-2025-53679

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

Score

CVSS 3.1 7.2 High

Status

Analyzed - psirt@fortinet.com

Published

2025-12-09

Last modified

2026-10-08

Weaknesses

CWE-78

Affected products

• Fortisandbox (Fortinet)
• Fortisandbox Cloud (Fortinet)
• Fortisandboxcloud (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-454