Medium5.4Fortinet

Medium [CVE-2025-68649] Path Traversal in CLI

This medium-severity Fortinet advisory covers CVE-2025-68649 affecting FortiManager, FortiAnalyzer.

FG-IR-26-120 Published Apr 14, 2026Updated by vendor Apr 14, 2026

CVE-2025-68649

Affected products & platforms

FortinetFortiManagerFortiAnalyzer

Open vendor advisory

Android app · Google Play

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

CVSSv3 Score: 5.4 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. Revised on 2026-04-14 00:00:00

Affected versions

FortiAnalyzer 7.6: 7.6.0 through 7.6.4
FortiAnalyzer 7.4: 7.4.0 through 7.4.7
FortiAnalyzer 7.2: 7.2 all versions
FortiAnalyzer 7.0: 7.0 all versions
FortiAnalyzer Cloud 7.6: 7.6.0 through 7.6.4
FortiAnalyzer Cloud 7.4: 7.4.0 through 7.4.7
FortiAnalyzer Cloud 7.2: 7.2 all versions
FortiAnalyzer Cloud 7.0: 7.0 all versions
FortiManager 7.6: 7.6.0 through 7.6.4
FortiManager 7.4: 7.4.0 through 7.4.7
FortiManager 7.2: 7.2 all versions
FortiManager 7.0: 7.0 all versions
FortiManager Cloud 7.6: 7.6.0 through 7.6.4
FortiManager Cloud 7.4: 7.4.0 through 7.4.7
FortiManager Cloud 7.2: 7.2 all versions
FortiManager Cloud 7.0: 7.0 all versions

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

FortiAnalyzer 7.6: 7.6.5
FortiAnalyzer 7.4: 7.4.8
FortiAnalyzer 7.2: migrate to a fixed release
FortiAnalyzer 7.0: migrate to a fixed release
FortiAnalyzer Cloud 7.6: 7.6.5
FortiAnalyzer Cloud 7.4: 7.4.8
FortiAnalyzer Cloud 7.2: migrate to a fixed release
FortiAnalyzer Cloud 7.0: migrate to a fixed release
FortiManager 7.6: 7.6.5
FortiManager 7.4: 7.4.8
FortiManager 7.2: migrate to a fixed release
FortiManager 7.0: migrate to a fixed release
FortiManager Cloud 7.6: 7.6.5
FortiManager Cloud 7.4: 7.4.8
FortiManager Cloud 7.2: migrate to a fixed release
FortiManager Cloud 7.0: migrate to a fixed release

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade per the Affected/Solution table: FortiAnalyzer 7.6: 7.6.5; FortiAnalyzer 7.4: 7.4.8; FortiAnalyzer 7.2: migrate to a fixed release; FortiAnalyzer 7.0: migrate to a fixed release; FortiAnalyzer Cloud 7.6: 7.6.5; ….

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Sources

Official and corroborating records used to build this advisory.

FortiGuard PSIRT Advisoriesofficial
Official vendor feed — the source of truth for this advisory. VulniPulse polled this feed and parsed this entry from it. Discovered from the machine-readable feed https://filestore.fortinet.com/fortiguard/rss/ir.xml; this link opens the Fortinet advisory index instead of the raw feed document.
Fortinet
Vendor advisory pageofficial
Advisory page fetched and parsed to extract affected/fixed versions and mitigation guidance beyond what the feed carries.
Fortinet

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2025-68649NVD CVE.org MITRE

Official resources

FortiManager documentation & upgrade guides
Official documentation
This advisory names 7.6 / 7.4 / 7.2 as the first fixed releases — official upgrade documentation for FortiManager.
FortiAnalyzer documentation & upgrade guides
Official documentation
This advisory names 7.6 / 7.4 / 7.2 as the first fixed releases — official upgrade documentation for FortiAnalyzer.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.