Path Traversal in Fortinet FortiVoice Allows File Deletion

Publication date: 2026-01-13

Last updated on: 2026-01-13

Assigner: Fortinet, Inc.

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-01-13

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58693

EUVD

EUVD-2026-2238

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortivoice	From 7.2.0 (inc) to 7.2.2 (inc)
fortinet	fortivoice	From 7.0.0 (inc) to 7.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Fortinet FortiVoice versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7. It allows a privileged attacker to delete files from the underlying filesystem by sending specially crafted HTTP or HTTPS requests that bypass directory restrictions.

Impact Analysis

The vulnerability can allow a privileged attacker to delete important files on the system, potentially disrupting service availability and causing data loss or system instability.

Hi! I’m here to help you understand CVE-2025-58693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70