CVE-2024-48885: Fortinet Fortirecorder

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.

Affected products

• Fortinet Fortirecorder: from 7.0.0, before 7.0.5 (fixed in 7.0.5); from 7.2.0, before 7.2.2 (fixed in 7.2.2)
• Fortinet Fortivoice: from 6.0.0, up to and including 6.4.10; from 7.0.0, up to and including 7.0.5
• Fortinet FortiWeb: from 6.4.0, before 7.4.5 (fixed in 7.4.5); version 7.6.0 only

Published 2025-01-16. Last modified 2026-07-08.