CVE-2025-67685 LOW

CVE-2025-67685

Vendor Fortinet
Product FortiSandbox
Weakness CWE-918 · SSRF
Published January 13, 2026
Last update January 14, 2026
View on NVD All CVEs

CVSS base score

3.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C

What the vulnerability does

01Description

A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
January 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-12801 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks CVE-2025-5186 thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery CVE-2024-0440 SSRF - file:// unsanitized access to underlying host files CVE-2026-2377 Mirror-registry: quay: quay: server-side request forgery via log export functionality CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image