Fortinet FortiDLP up to 11.5.1 on macOS Outlookproxy path traversal

Summaryinfo

A vulnerability has been found in Fortinet FortiDLP up to 11.5.1 on macOS and classified as critical. The affected element is an unknown function of the component Outlookproxy. This manipulation causes path traversal. This vulnerability is tracked as CVE-2025-54658. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Fortinet FortiDLP up to 11.5.1 on macOS. Affected by this vulnerability is an unknown part of the component Outlookproxy. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to Root via sending a crafted request to a local listening port.

It is possible to read the advisory at fortiguard.fortinet.com. This vulnerability is known as CVE-2025-54658 since 07/28/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiDLP

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.3.0
• 10.3.1
• 10.4.0
• 10.5.0
• 10.5.1
• 11.0
• 11.0.0
• 11.0.1
• 11.1
• 11.1.0
• 11.1.1
• 11.1.2
• 11.2.0
• 11.2.1
• 11.2.2
• 11.2.3
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 11.5.0
• 11.5.1

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion