Description
Fortinet FortiWeb 是一款广泛使用的 Web 应用防火墙产品。该漏洞属于路径遍历类型，攻击者可以通过构造特定的请求路径绕过权限验证，访问受保护的资源或执行未授权的操作，可能导致敏感信息泄露或系统被进一步利用。
Fortinet FortiWeb /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi 权限绕过漏洞（CVE-2025-64446）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-64446
https://fortiguard.fortinet.com/psirt/FG-IR-25-910
https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/
https://cloud.tencent.com/developer/article/2592965
https://zhuanlan.zhihu.com/p/1973824884930003713
https://arcticwolf.com/resources/blog/cve-2025-64446/
https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/
https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass
https://www.greynoise.io/blog/fortiweb-cve-2025-64446
https://bishopfox.com/blog/fortinet-fortiweb-authentication-bypass-cve-2025-64446