PT-2025-50115 · Fortinet · Fortisandbox

Published 2025-12-09 · Updated 2025-12-16 · CVE-2025-54353

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 4.0 all versions Fortinet FortiSandbox versions 4.2 all versions Fortinet FortiSandbox versions 4.4.0 through 4.4.7 Fortinet FortiSandbox versions 5.0.0 through 5.0.2

Description An Improper Neutralization of Input During Web Page Generation issue exists in Fortinet FortiSandbox. This issue may allow an attacker to perform a Cross-Site Scripting (XSS) attack via specially crafted HTTP requests.

Recommendations Fortinet FortiSandbox versions prior to 4.0 should be updated. Fortinet FortiSandbox versions prior to 4.2 should be updated. Fortinet FortiSandbox versions prior to 4.4.0 or later than 4.4.7 should be updated. Fortinet FortiSandbox versions prior to 5.0.0 or later than 5.0.2 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00831

CVE-2025-54353

ZDI-25-1098

Affected Products

Fortisandbox

References · 6

• https://bdu.fstec.ru/vul/2026-00831 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54353 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-1098 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54353 · Security Note
• https://twitter.com/CVEnew/status/1998781395632619602 · Twitter Post