# FortiWeb path traversal enables unauthenticated RCE

Published: 2026-06-09 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/684c6b89-ca69-5656-8cd5-536d62c1814a/fortiweb-path-traversal-enables-unauthenticated-rce

> Unpatched FortiWeb versions allow unauthenticated attackers to execute admin commands via HTTP/HTTPS requests; actively exploited.

Fortinet's FortiWeb web application firewall contains a relative path traversal vulnerability (CVE-2025-64446) that permits unauthenticated attackers to execute administrative commands on affected systems through specially crafted HTTP or HTTPS requests. The vulnerability affects FortiWeb versions 8.0.0–8.0.1, 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.0–7.2.11, and 7.0.0–7.0.11. Fortinet has confirmed active in-the-wild exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities Catalog, indicating this is a genuine operational threat requiring immediate action.

Successful exploitation grants attackers administrative-level command execution on the FortiWeb appliance itself. The attack requires no authentication and relies only on network access to the HTTP or HTTPS management interface. Organizations following network security best practice by restricting the management interface to internal networks only reduce exposure, but any organization with internet-facing or untrusted-network access to the management plane is at immediate risk. Defenders should prioritize patching over all other work and verify that management interfaces are not externally accessible.

## Mentioned in this report

- Vulnerabilities: CVE-2025-64446 (KEV)

## Detection guidance (public sample)

### Path Traversal Sequences in Request to Web Management Interface with Successful Response

ATT&CK: T1190

Detects ../ or encoded traversal sequences in the URI path or query that return HTTP 2xx, the request pattern used against relative path traversal flaws such as CVE-2025-64446 in FortiWeb. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Sequences in Request to Web Management Interface with Successful
  Response
id: 2743ef5a-e7d0-50bf-89d1-244fd8949e89
status: experimental
description: Detects relative path traversal sequences (plain, URL-encoded or double-encoded)
  in the URI of web requests that receive a successful 2xx response. This is the request
  pattern used to exploit unauthenticated relative path traversal flaws in management
  interfaces such as FortiWeb CVE-2025-64446. Best applied to logs from the appliance,
  a reverse proxy or a WAF in front of management interfaces.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-stem|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - '%252e%252e'
  selection_traversal_query:
    cs-uri-query|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - '%252e%252e'
  selection_status:
    sc-status:
    - 200
    - 201
    - 202
    - 204
  condition: 1 of selection_traversal* and selection_status
falsepositives:
- Vulnerability scanners or penetration tests run against the management interface
- Poorly written web applications that legitimately pass relative paths in query parameters
level: medium
author: Vorant
```

### Path Traversal Sequences in HTTP Request Through Proxy

ATT&CK: T1190

Detects traversal sequences in request URIs seen in proxy or WAF logs that may indicate exploitation of path traversal RCE flaws in public-facing management interfaces such as FortiWeb. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Sequences in HTTP Request Through Proxy
id: f116058c-b862-5870-9c24-657dd2a0f5f8
status: experimental
description: Detects relative path traversal sequences in the URI of HTTP or HTTPS
  requests visible in proxy or reverse-proxy logs, indicating possible exploitation
  of unauthenticated path traversal flaws in public-facing appliance management interfaces
  such as FortiWeb CVE-2025-64446. Requires logging of the full requested URI.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
    - /../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - '%252e%252e'
  selection_method:
    cs-method:
    - POST
    - PUT
    - GET
  condition: selection and selection_method
falsepositives:
- Security scanners and red-team exercises testing for path traversal
- Web applications that embed relative paths in URL parameters
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/684c6b89-ca69-5656-8cd5-536d62c1814a/fortiweb-path-traversal-enables-unauthenticated-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup