CVE-2025-67685

Low · 3.8

CVSS

3.8

EPSS

0.4%

Published

Jan 13, 2026

CISA due date

—

The record

A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

Affected packages

Ecosystem	Package	Introduced	Fixed