CVE-2025-64446
KEVCRITICAL 9.8EPSS 92.0%
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
- Affected
- Fortinet · FortiWeb
- CVSS v3.1 FORTINET
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 91.97% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-11-14
- Nuclei
- critical · CWE-23
- Published
- 2025-11-14
- Updated
- 2026-02-26
Proof-of-concept exploits (11)
- 0xBlackash/CVE-2025-644460★ · 2026-04-07
- AN5I/cve-2025-64446-fortiweb-exploit1★ · 2025-11-21
- CerberusMrXi/FortiWeb-cve-2025-64446-RCE-exploit2★ · 2026-07-30
- D3crypT0r/CVE-2025-644460★ · 2025-11-17
- eagle-nett/FORTIWEB_CVE-2025-64446-580340★ · 2026-04-07
- fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal7★ · 2025-11-14
- lequoca/fortinet-fortiweb-cve-2025-64446-580340★ · 2025-12-21
- litndat/Vulnerability-CVE-2025-64446-CVE-2025-580340★ · 2026-06-24
- soltanali0/CVE-2025-64446-Exploit15★ · 2025-11-15
- sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC14★ · 2025-11-14
- verylazytech/CVE-2025-644463★ · 2025-11-19
Nuclei templates (1)
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_fortiweb_rce…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortinet_fortiweb_cr…