CVE-2025-24470

An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests.

Scoring

Severity

HIGH

CVSS base score

8.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:X/RC:C

EPSS probability

1.33%

CWE

CWE-41

Published

2025-02-11

Last modified

2026-03-12

Affected products

• Fortinet FortiPortal
• Fortinet FortiPortal
• Fortinet FortiPortal

Weakness type

• CWE-41

Related vulnerabilities

• CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
• CVE-2026-73019 — Windows URL Moniker Security Feature Bypass Vulnerability
• CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
• CVE-2026-66064 — goshs has ACL Bypass & Path Traversal
• CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
• CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
• CVE-2026-5816 — Improper Resolution of Path Equivalence in GitLab
• CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

Markdown version · Browse all CVEs