{"id":"CVE-2024-52964","aliases":["EUVD-2024-54874","GHSA-535p-g7m4-r8xm"],"status":"published","title":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ...","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 \u0026 FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.","severity":{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00688,"percentile":0.53042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-08-12T18:59:45Z","modified":"2026-06-17T08:07:56Z","products":[{"vendor":"fortinet","product":"fortimanager"},{"vendor":"fortinet","product":"fortimanager_cloud"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-473","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52964"},{"url":"https://github.com/advisories/GHSA-535p-g7m4-r8xm"}],"sources":{"cve":[{"id":"CVE-2024-52964","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 \u0026 FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.","status":"published","published":"2025-08-12T18:59:45.473Z","modified":"2025-08-13T20:13:55.667Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-54874","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 \u0026 FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.","status":"published","published":"2025-08-12T18:59:45Z","modified":"2025-08-13T20:13:55Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C","level":"medium"}],"updated_at":"2026-11-02T20:31:58.34572Z"}],"ghsa":[{"id":"GHSA-535p-g7m4-r8xm","title":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ...","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 \u0026 FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.","status":"published","published":"2025-08-12T21:31:20Z","modified":"2025-08-12T21:31:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:03:16.090631Z"}],"nvd":[{"id":"CVE-2024-52964","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 \u0026 FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.","status":"published","published":"2025-08-12T19:15:27.72Z","modified":"2026-06-17T08:07:56.28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:47.444899Z"}]}}