CVE-2025-58034 Fortinet FortiWeb OS Command Injection
An authenticated attacker can execute unauthorized code on FortiWeb systems via crafted HTTP requests or CLI commands.
- Exploited in the wild
- Since 18 Nov 2025
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-58034?
CVE-2025-58034 is a medium-severity command injection vulnerability in Fortinet Fortiweb, published on 18 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Weakness: CWE-78
Which versions are affected by CVE-2025-58034?
It affects 1 product.
Products include Fortinet Fortiweb.
How do I fix CVE-2025-58034?
No fix has been published for CVE-2025-58034 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Nov 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-58034 being exploited?
Yes. Attackers have exploited CVE-2025-58034 in the wild since at least 18 Nov 2025.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Fortinet Fortiweb
Sources
Also known as GHSA-47cr-8w72-ggmc.