FortiManager and FortiAnalyzer path traversal lets read-only users write and delete files (CVE-2025-61625)

What happened

Fortinet describes the flaw as an improper limitation of a pathname to a restricted directory, known as path traversal, in the FortiManager and FortiAnalyzer JSON API. An attacker who can authenticate with a profile that only has read permission can send crafted HTTP or HTTPS requests to write and delete files on the underlying filesystem. The attack requires network access to the API, low privileges and no user interaction, so it matters even when the account is intentionally limited to read-only use.

Fortinet rates the vulnerability high severity with a CVSS 3.1 score of 7.3. The vector lists no confidentiality impact and high integrity and availability impact. Fortinet has not reported active exploitation, and the CVE record does not list the flaw in CISA's Known Exploited Vulnerabilities catalogue. The vulnerability has not been publicly disclosed according to the record.

Who is affected

Fortinet lists the following affected versions:

• FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11
• FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.11
• FortiManager Cloud 7.6.0 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.10

These products typically sit in central management and log analytics roles. The JSON API is reachable over HTTP or HTTPS. Fortinet's advisory does not yet list fixed versions.

What to do now

1. Restrict access to the FortiManager and FortiAnalyzer management and JSON API endpoints to trusted management networks or a dedicated interface. Do not leave them directly reachable from the internet.
2. Review every account whose profile only has read permission. Remove or suspend those that are not operationally necessary, and use separate credentials for automated or third-party access.
3. Monitor the affected systems for unexpected file writes or deletions, and treat changes originating from read-only API accounts as suspicious.
4. Watch Fortinet's FG-IR-26-190 advisory for fixed releases or a vendor workaround. As no fix or workaround has been published yet, do not apply unsupported patches.

How to detect it

Fortinet has not published indicators of compromise for this flaw. Review FortiManager and FortiAnalyzer API logs for HTTP or HTTPS requests from read-only profiles that correspond to file write or delete operations. Investigate any unexpected file creation or deletion on the underlying filesystem, and correlate those changes with API access by low-privilege or read-only accounts.

Beyond the patch

Beyond immediate containment, this is a reminder that a read-only API account is still an attack surface if the API has a flaw. Supply Chain Defense & Third-Party Risk helps you track which Fortinet versions you run and the vendor patch cycle that will eventually close this exposure. If a low-privilege account is misused, Managed Detection & Response can detect the resulting file write and delete activity on the host.