# CVE-2025-61625

Authenticated path traversal allows file write/delete on FortiAnalyzer/FortiManager

- Page: https://www.vulneraibility.com/cve/CVE-2025-61625
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-10)
- Weakness: CWE-22
- Published: 2026-11-10

## Affected versions

- Fortinet FortiAnalyzer: affected >= 7.6.0 and <= 7.6.4; >= 7.4.0 and <= 7.4.7; >= 7.2.0 and <= 7.2.11
- Fortinet FortiManager: affected >= 7.6.0 and <= 7.6.4; >= 7.4.0 and <= 7.4.7; >= 7.2.0 and <= 7.2.11
- Fortinet FortiManager Cloud: affected >= 7.6.0 and <= 7.6.4; >= 7.4.1 and <= 7.4.7; >= 7.2.1 and <= 7.2.10

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated low-privilege user can write and delete filesystem files via crafted HTTP(S) requests, enabling tampering, persistence, or denial-of-service.

## Action

Immediate action required

## Recommendation

Apply vendor patch/mitigation when available; restrict management UI, remove/limit low-privilege accounts.

## References

- [other] https://fortiguard.fortinet.com/psirt/FG-IR-26-190

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.