CVEFinder.io

CVE-2025-60024

⚠️ high
🔍 Scan for this CVE
Summary

Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands

CVSS Score
8.8
High
EPSS Score
0.1
Exploit Probability
Published Date
2025-12-09
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 326,604 vulnerabilities in our database.

#61,754
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Dec 9, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2025-12-09
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-22

📦 Affected Products 2

Vendor Product Status Affected Versions
fortinet fortivoice Affected
≥ 7.0.0 < 7.0.8
fortinet fortivoice Affected
≥ 7.2.0 < 7.2.3

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-25-812
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2024-23104 🔶 medium 5.4 0.0 An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 t... 2026-04-14
CVE-2025-55717 🔶 medium 4.0 0.0 A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7... 2026-03-10
CVE-2025-58693 🔶 medium 6.5 0.2 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7... 2026-01-13
CVE-2025-64156 ⚠️ high 7.2 0.1 An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiV... 2025-12-09
CVE-2025-58692 ⚠️ high 8.8 0.0 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerabi... 2025-11-18
CVE-2024-47569 🔶 medium 4.3 0.0 A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7... 2025-10-14
These CVEs affect the same products