{"basis":"claimed","id":"CVE-2025-64446","name":"Fortinet FortiWeb Path Traversal Vulnerability","vendorProject":"Fortinet","product":"FortiWeb","publishedAt":"2025-11-14","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-11-14","dueDate":"2025-11-21","ransomware":false},"epss":{"score":0.91078,"percentile":0.99808,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-11-24","daysToRule":10},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-12-03","daysToRule":19},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","cwes":["CWE-23"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-11-24","firstIsNew":true,"daysToRule":10,"daysAtMost":null,"freePlan":false,"claims":[{"id":"31f77469490d47d8cfa849dc72290e35070dc8974ae2e56252377ddbbf3584bd","cve_id":"CVE-2025-64446","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"b957ace6e9844bf29244401c4e2e1a2e","rule_name":"FortiWeb - Authentication Bypass via CGIINFO Header - CVE:CVE-2025-64446","change":"new","default_action":"Block","published_on":"2025-11-24","source_url":"https://developers.cloudflare.com/changelog/post/2025-11-24-waf-release/","source_title":"WAF Release - 2025-11-24","excerpt":"FortiWeb - Authentication Bypass via CGIINFO Header - CVE:CVE-2025-64446. Previous action: Log. New action: Block. This is a new detection","first_seen_at":"2026-11-02T21:00:15.584Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-12-03","firstIsNew":true,"daysToRule":19,"daysAtMost":null,"freePlan":false,"claims":[{"id":"c8cfc3d6cd12d3deea737a971c94467b3980ade675e3b84ea297ae39fbe21805","cve_id":"CVE-2025-64446","vendor":"f5","product":"Attack signatures","rule_id":"200007106","rule_name":"Fortinet FortiWeb Path Traversal","change":"new","default_action":null,"published_on":"2025-12-03","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007106 \"Fortinet FortiWeb Path Traversal\" (Path Traversal, risk Medium), systems: Other Web Server. References: CVE-2025-64446.","first_seen_at":"2026-11-02T21:00:25.304Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:40.558Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2025-64446","templatePath":"http/cves/2025/CVE-2025-64446.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110","930120"],"note":"","requestDetail":[{"method":"POST","path":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi","status":403,"blocked":true,"rules":["930100","930110","930120"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2025-64446","templatePath":"http/cves/2025/CVE-2025-64446.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110","930120"],"note":"","requestDetail":[{"method":"POST","path":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi","status":403,"blocked":true,"rules":["930100","930110","930120"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}