A Vulnerability in FortiWeb Could Allow for Remote Code Execution

A relative path traversal vulnerability (CWE-23) in FortiWeb (CVE-2025-64446) may allow unauthenticated attackers to execute administrative commands and achieve remote code execution via crafted HTTP/HTTPS requests. The advisory maps the issue to Initial Access (Exploit Public-Facing Application, T1190) and notes that restricting the HTTP/HTTPS management interface to internal access reduces risk; the report does not state any observed active exploitation.