CVE-2025-64446 Detail

Nvd.Nist • November 14, 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Cybersecurity Software CVE-2025-64756 identifies a command injection vulnerability in the glob CLI affecting versions 10.3.7 to 11.0.3. CVE-2025-64446 reveals a relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0 to 8.0.1 and earlier, allowing attackers to execute administrative commands via crafted requests. 19 sources 50

Extracted Entities

CVEs (1)

CVE-2025-64446

Vulnerabilities (2)

FortiWeb Relative Path Traversal