CVE-2024-48885 is an improper limitation of a pathname to a restricted directory (path traversal) vulnerability affecting multiple Fortinet products including FortiVoice versions 6.0.0, 6.4.0 through 6.4.9, and 7.0.0 through 7.0.4. This flaw allows an attacker to escalate privileges by sending specially crafted packets that exploit the path traversal weakness. The vulnerability has been assigned a CVSS 3.1 base score of 5.2, indicating medium severity. Fortinet has released an official fix to remediate this issue.

The vulnerability enables an attacker with low privileges to escalate their privileges on affected FortiVoice systems by exploiting a path traversal flaw. While confidentiality and integrity impacts are not indicated, the vulnerability results in a high impact on availability. There are no known exploits in the wild at this time.

An official fix is available from Fortinet to remediate this vulnerability. Users of affected FortiVoice versions should apply the vendor-supplied patches promptly to mitigate the risk of privilege escalation via path traversal. Since this is an official fix, no additional temporary mitigations are indicated.