{"api_version":"1","generated_at":"2026-10-24T01:42:27+00:00","cve":"CVE-2025-64446","urls":{"html":"https://cve.report/CVE-2025-64446","api":"https://cve.report/api/cve/CVE-2025-64446.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-64446","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-64446"},"summary":{"title":"CVE-2025-64446","description":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","state":"PUBLISHED","assigner":"fortinet","published_at":"2025-11-14 16:15:58","updated_at":"2026-10-18 20:10:00"},"problem_types":["CWE-23","CWE-23 Escalation of privilege"],"metrics":[{"version":"3.1","source":"psirt@fortinet.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.4","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","version":"3.1"}}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-910","name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-910","refsource":"psirt@fortinet.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass","name":"https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446","name":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64446","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64446","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Fortinet","product":"FortiWeb","version":"affected 8.0.0 8.0.1 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiWeb","version":"affected 7.6.0 7.6.4 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiWeb","version":"affected 7.4.0 7.4.9 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiWeb","version":"affected 7.2.0 7.2.11 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiWeb","version":"affected 7.0.0 7.0.11 semver","platforms":[]}],"timeline":[{"source":"ADP","time":"2025-11-20T21:16:49.289Z","lang":"en","value":"Previously entered references were removed because they are not applicable to this CVE Record."}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to FortiWeb version 8.0.2 or above\nUpgrade to FortiWeb version 7.6.5 or above\nUpgrade to FortiWeb version 7.4.10 or above\nUpgrade to FortiWeb version 7.2.12 or above\nUpgrade to FortiWeb version 7.0.12 or above","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"64446","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiweb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":{"cve_year":"2025","cve_id":"64446","cve":"CVE-2025-64446","vendorProject":"Fortinet","product":"FortiWeb","vulnerabilityName":"Fortinet FortiWeb Path Traversal Vulnerability","dateAdded":"2025-11-14","shortDescription":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-11-21","knownRansomwareCampaignUse":"Unknown","notes":"https://www.fortiguard.com/psirt/FG-IR-25-910 ; https://nvd.nist.gov/vuln/detail/CVE-2025-64446","cwes":"CWE-23","catalogVersion":"2026.10.23","updated_at":"2026-10-23 17:31:21"},"epss":{"cve_year":"2025","cve_id":"64446","cve":"CVE-2025-64446","epss":"0.919650000","percentile":"0.998220000","score_date":"2026-10-23","updated_at":"2026-10-24 00:06:31"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-64446","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-15T04:56:17.687579Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2025-11-14","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-02-26T16:56:56.973Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"},{"tags":["exploit"],"url":"https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-11-20T21:16:49.529Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"timeline":[{"lang":"en","time":"2025-11-20T21:16:49.289Z","value":"Previously entered references were removed because they are not applicable to this CVE Record."}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}}],"cna":{"affected":[{"cpes":["cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiWeb","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.11","status":"affected","version":"7.0.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","description":"Escalation of privilege","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-01-14T09:16:10.074Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet"},"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-910","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-910"}],"solutions":[{"lang":"en","value":"Upgrade to FortiWeb version 8.0.2 or above\nUpgrade to FortiWeb version 7.6.5 or above\nUpgrade to FortiWeb version 7.4.10 or above\nUpgrade to FortiWeb version 7.2.12 or above\nUpgrade to FortiWeb version 7.0.12 or above"}]}},"cveMetadata":{"assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","assignerShortName":"fortinet","cveId":"CVE-2025-64446","datePublished":"2025-11-14T15:50:52.778Z","dateReserved":"2025-11-04T14:26:34.042Z","dateUpdated":"2026-02-26T16:56:56.973Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-11-14 16:15:58","lastModifiedDate":"2026-10-18 20:10:00","problem_types":["CWE-23","CWE-23 Escalation of privilege"],"metrics":{"cvssMetricV31":[{"source":"psirt@fortinet.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-15T04:56:17.687579Z","id":"CVE-2025-64446","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.12","matchCriteriaId":"CDE13E2A-CEC3-4FC7-98AD-11CA1EAEC0C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.12","matchCriteriaId":"551127B2-DCE9-403D-8073-ACD717CD0B19"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"7.4.0","versionEndExcluding":"7.4.10","matchCriteriaId":"83212B0A-5EEF-4FA7-89C5-5E4D687CBB07"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"7.6.0","versionEndExcluding":"7.6.5","matchCriteriaId":"D358CE92-A30D-4058-8D12-00376E4B9074"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.2","matchCriteriaId":"F1DD8ABA-9BB5-4ED8-9E34-1CB0752651DF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"64446","Ordinal":"1","Title":"CVE-2025-64446","CVE":"CVE-2025-64446","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"64446","Ordinal":"1","NoteData":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","Type":"Description","Title":"CVE-2025-64446"}]}}}