CVE-2025-54822

State: Published
Severity: 4.2 Medium
Published: Oct 14, 2025
Updated: Jan 14, 2026
Reserved: Jul 30, 2025

Description

An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C	fortinet

Weaknesses

CWE-285 Improper access control

Affected Products

Product	Versions
FortiProxyFortinet	7.4.0 through 7.4.8Affected 7.2.0 through 7.2.15Affected 7.0.0 through 7.0.22Affected 2.0.0 through 2.0.14Affected
FortiOSFortinet	7.4.0 through 7.4.1Affected 7.2.0 through 7.2.8Affected 7.0.0 through 7.0.11Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-684

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.