References https://fortiguard.fortinet.com/psirt/FG-IR-25-151 https://nvd.nist.gov/vuln/detail/CVE-2025-25257 https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/ https://www.cnblogs.com/gobybot/p/18988165 https://cloud.tencent.com/developer/article/2549786 https://www.ithome.com.tw/news/169971 https://blog.csdn.net/b3n4m5q6w7/article/details/151202951 https://zeropath.com/blog/fortinet-fortiweb-cve-2025-25257-sql-injection-rce https://www.rapid7.com/db/vulnerabilities/fortinet-fortiweb-cve-2025-25257/ https://arcticwolf.com/resources/blog/cve-2025-25257/
Related VulnerabilitiesPoCCVE-2026-39808: Fortinet FortiSandbox - Command InjectionFortinet FortiSandbox /fortisandbox/job-detail/tracer-behavior 命令执行漏洞(CVE-2026-39808)PoCCVE-2026-21643: Fortinet FortiClientEMS 7.4.4 - SQL InjectionPoCCVE-2025-52970: Fortinet FortiWeb - Authentication Bypass to Admin PrivilegeFortinet FortiOS等 签名验证不当漏洞Fortinet FortiWeb /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi 权限绕过漏洞(CVE-2025-64446/CVE-2025-58034)Fortinet FortiWeb 需授权 命令注入漏洞PoCCVE-2025-64446: FortiWeb - Authentication BypassFortinet FortiWeb /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi 权限绕过漏洞(CVE-2025-64446)Fortiweb 存在路径穿越漏洞(CVE-2025-64446)