Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2025-61624

5.4 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): HIGH
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): HIGH
Availability impact (A): HIGH

updated 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 weeks ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks ago

An Improper Limitation of a Pathname to a Restricted Directory …

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Affected products

FortiOS

=<7.6.4
=<7.4.9
=<7.2.13
=<6.4.16
=<7.0.19

FortiPAM

=<1.4.3
==1.2.0
=<1.1.2
=<1.6.2
=<1.5.1
==1.7.0
=<1.0.3
=<1.3.1

FortiProxy

=<7.6.4
=<7.2.16
=<7.0.23
=<7.4.11

FortiSwitchManager

=<7.0.6
=<7.2.7

Matching in nixpkgs

pkgs.terraform-providers.fortios

None

nixos-unstable 1.24.1
- nixpkgs-unstable 1.24.1
- nixos-unstable-small 1.24.1
nixos-25.11 1.23.0
- nixos-25.11-small 1.23.0
- nixpkgs-25.11-darwin 1.23.0

pkgs.python312Packages.fortiosapi

Python module to work with Fortigate/Fortios devices

nixos-25.11 1.0.5
- nixos-25.11-small 1.0.5
- nixpkgs-25.11-darwin 1.0.5

pkgs.python313Packages.fortiosapi

Python module to work with Fortigate/Fortios devices

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5
nixos-25.11 1.0.5
- nixos-25.11-small 1.0.5
- nixpkgs-25.11-darwin 1.0.5

pkgs.python314Packages.fortiosapi

Python module to work with Fortigate/Fortios devices

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5

pkgs.terraform-providers.fortinetdev_fortios

None

nixos-unstable 1.24.1
- nixpkgs-unstable 1.24.1
- nixos-unstable-small 1.24.1
nixos-25.11 1.23.0
- nixos-25.11-small 1.23.0
- nixpkgs-25.11-darwin 1.23.0

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Dismissed

(not in Nixpkgs)

Permalink CVE-2025-53847

6.2 MEDIUM

CVSS version: 3.1
Attack vector (AV): ADJACENT_NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): HIGH
Availability impact (A): NONE

updated 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 weeks ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks ago

A missing authentication for critical function vulnerability in Fortinet FortiOS …

A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.