What’s Vulnerable › Vulnerabilities

CVE-2024-48884

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-14 · updated 2026-10-22
• Weakness: CWE-22

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder

Affected products

• Fortinet FortiManager: from 7.4.1 before 7.4.4; from 7.6.0 before 7.6.2 — fixed in 7.4.4, 7.6.2
• Fortinet FortiManager Cloud: from 7.4.1 before 7.4.4 — fixed in 7.4.4
• Fortinet FortiOS (FortiGate): from 6.4.0 before 6.4.16; from 7.0.0 before 7.0.16; from 7.2.0 before 7.2.10; from 7.4.0 before 7.4.5; 7.6.0 — fixed in 6.4.16, 7.0.16, 7.2.10, 7.4.5
• Fortinet FortiProxy: from 1.0.0 before 7.0.19; from 7.2.0 before 7.2.12; from 7.4.0 before 7.4.6 — fixed in 7.0.19, 7.2.12, 7.4.6
• Fortinet FortiRecorder: from 7.0.0 before 7.0.5; from 7.2.0 before 7.2.2 — fixed in 7.0.5, 7.2.2
• Fortinet FortiVoice: from 6.0.0 through 6.4.10; from 7.0.0 through 7.0.5
• Fortinet FortiWeb: from 6.4.0 before 7.4.5; 7.6.0 — fixed in 7.4.5

How to fix

Upgrade to a fixed version: Fortinet FortiManager 7.4.4, 7.6.2; Fortinet FortiManager Cloud 7.4.4; Fortinet FortiOS (FortiGate) 6.4.16, 7.0.16, 7.2.10, 7.4.5; Fortinet FortiProxy 7.0.19, 7.2.12, 7.4.6; Fortinet FortiRecorder 7.0.5, 7.2.2; Fortinet FortiWeb 7.4.5. Check the vendor advisory for mitigations.

References

• https://fortiguard.fortinet.com/psirt/FG-IR-24-259

Get alerted when CVE-2024-48884 or the next vulnerability affects your stack