Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet FortiWeb

Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Added to CISA KEV on 2025-11-18 (federal deadline 2025-11-25).

First seen: 18 Nov 2025
Last update: 18 Nov 2025, 12:00 UTC
Identifiers: CVE-2025-58034
Source: CISA KEV
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Fortinet FortiWeb OS Command Injection Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Fortinet FortiWeb
Ids: CVE-2025-58034

Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Added to CISA KEV on 2025-11-18 (federal deadline 2025-11-25).

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-58034") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://fortiguard.fortinet.com/psirt/FG-IR-25-513 https://nvd.nist.gov/vuln/detail/CVE-2025-58034
https://pwned.coffee/i/fortinet-fortiweb-os-command-injection-vulnerability-cve-2025-58034

Sources

Totalone hot coffee