Loading vulnerability…
Arbitrary File Write via Path Traversal in Fortinet FortiVoice
CVE-2025-60024 is a high-severity path traversal vulnerability in Fortinet FortiVoice affecting versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7. The flaw is described as multiple improper limitations of a pathname to a restricted directory, allowing a privileged authenticated attacker to send crafted HTTP or HTTPS commands that traverse intended directory boundaries and write arbitrary files on the target system. Based on the available information, the issue is remotely exploitable over the network and stems from insufficient restriction of file paths used by the affected HTTP/HTTPS-exposed functionality.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker with privileges to write arbitrary files on the FortiVoice system. Given the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the impact can include compromise of confidentiality, integrity, and availability. Arbitrary file write may enable configuration tampering, planting of malicious files, service disruption, unauthorized modification of application or system data, and potentially follow-on compromise depending on what paths and files are writable in the deployment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to the vulnerable HTTP/HTTPS management or command interfaces as much as operationally feasible. Limit exposure to trusted administrative networks only, reduce the number of accounts with the required privileges, and monitor for suspicious file-write activity or unexpected changes on the appliance until patches can be applied.
Patch, then assume compromise.
Upgrade Fortinet FortiVoice to a fixed release beyond 7.2.2 for the 7.2 branch or beyond 7.0.7 for the 7.0 branch, and apply the security updates provided by Fortinet. Follow Fortinet advisory FG-IR-25-812 for vendor-specific patch guidance and validated fixed-version information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.