{"id":"CVE-2025-53609","aliases":["EUVD-2025-27259","GHSA-9rc9-f47x-pvpx"],"status":"published","title":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7...","description":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.11506,"percentile":0.96051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-23"],"published":"2025-09-09T13:50:41Z","modified":"2026-06-17T09:38:34Z","products":[{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-512","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53609"},{"url":"https://github.com/advisories/GHSA-9rc9-f47x-pvpx"}],"sources":{"cve":[{"id":"CVE-2025-53609","description":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.","status":"published","published":"2025-09-09T13:50:41.345Z","modified":"2026-01-14T09:17:25.658Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-27259","description":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.","status":"published","published":"2025-09-09T13:50:41Z","modified":"2026-01-14T09:17:25Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","level":"medium"}],"updated_at":"2026-11-02T19:48:52.227329Z"}],"ghsa":[{"id":"GHSA-9rc9-f47x-pvpx","title":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7...","description":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.","status":"published","published":"2025-09-09T15:31:19Z","modified":"2025-09-09T15:31:26Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:03:32.650929Z"}],"nvd":[{"id":"CVE-2025-53609","description":"A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.","status":"published","published":"2025-09-09T14:15:46.363Z","modified":"2026-06-17T09:38:34.697Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:11:27.73916Z"}]}}