CVE-2025-54658
Last modified
CVE-2025-54658 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to Root via sending a crafted request to a local listening port.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to Root via sending a crafted request to a local listening port.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortidlp Agent | >= 10.3.1, <= 11.5.1 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-628Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54658?
How severe is CVE-2025-54658?
How do I fix CVE-2025-54658?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54652Path traversal vulnerability in the virtualization base modu…5.5
- CVE-2025-54653Path traversal vulnerability in the virtualization file modu…6.5
- CVE-2025-54654Permission control vulnerability in the Gallery module. Succ…5.5
- CVE-2025-54655Race condition vulnerability in the virtualization base modu…7.8
- CVE-2025-54656** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralizati…6.5
- CVE-2025-54657Rejected reason: Not used
- CVE-2025-54659An Improper Limitation of a Pathname to a Restricted Directo…7.5
- CVE-2025-5466XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivan…4.9
- CVE-2025-54660An active debug code vulnerability in Fortinet FortiClientWi…5.5
- CVE-2025-54661Rejected reason: Not used
- CVE-2025-54662Rejected reason: Not used
- CVE-2025-54663Rejected reason: Not used
Are you affected by CVE-2025-54658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST