Description
攻击者可能利用该漏洞，通过精心编制的 HTTP 或 HTTPS 请求在系统上执行管理命令。
Fortiweb 存在路径穿越漏洞（CVE-2025-64446）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-64446
https://fortiguard.fortinet.com/psirt/FG-IR-25-910
https://www.cve.org/CVERecord?id=CVE-2025-64446
https://www.picussecurity.com/resource/blog/fortiweb-cve-2025-64446-vulnerability-path-traversal-leads-to-remote-code-execution
https://arcticwolf.com/resources/blog/cve-2025-64446/
https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446
https://bishopfox.com/blog/fortinet-fortiweb-authentication-bypass-cve-2025-64446
https://www.greynoise.io/blog/fortiweb-cve-2025-64446
https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/