This vulnerability (CVE-2025-61624) is an improper limitation of a pathname to a restricted directory (path traversal) affecting Fortinet FortiOS versions 6.4.0 through 7.6.4, FortiPAM versions 1.0 through 1.7.0, FortiProxy versions 7.0 through 7.6.4, and FortiSwitchManager versions 7.0.0 through 7.2.7. It allows an authenticated attacker with admin privileges and at least read-write access to execute specific CLI commands that can write or delete arbitrary files on the affected system. The vulnerability is officially fixed by Fortinet, and patches are available.

Exploitation of this vulnerability allows an authenticated administrator-level user to write or delete arbitrary files on the affected Fortinet devices. This can lead to unauthorized modification or deletion of critical system files, potentially impacting system integrity and availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.

An official fix is available from Fortinet for this vulnerability. It is recommended to apply the vendor-provided patches promptly to affected versions of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Since the vulnerability requires authenticated admin-level access, ensure that administrative credentials are well protected and access is limited to trusted personnel.