CVE-2024-48885 is a medium severity (CVSS 5.3) path traversal in Fortinet FortiRecorder, FortiVoice and FortiWeb. Specially crafted packets let an attacker escalate privilege on the device. Fortinet lists fixed releases in advisory FG-IR-24-259, and a workaround is to disable the Security Fabric.
What's affected
From Fortinet advisory FG-IR-24-259, for the products in this record:
- FortiRecorder 7.2.0 through 7.2.1: upgrade to 7.2.2 or above. FortiRecorder 7.0.0 through 7.0.4: upgrade to 7.0.5. FortiRecorder 6.4 is not affected.
- FortiVoice 7.0.0 through 7.0.4: upgrade to 7.0.5. FortiVoice 6.4.0 through 6.4.9: upgrade to 6.4.10. FortiVoice 6.0, all versions: migrate to a fixed release. FortiVoice 7.2 is not affected.
- FortiWeb 7.6.0: upgrade to 7.6.1. FortiWeb 7.4.0 through 7.4.4: upgrade to 7.4.5. FortiWeb 7.2, 7.0 and 6.4, all versions: migrate to a fixed release.
The same advisory also covers CVE-2024-48884, which has a wider list of products.
How to check if you're exposed
Check each unit version on the console or CLI.
get system status
Compare to the list above, paying attention to the branches where Fortinet says to migrate, because those have no fix inside the branch. Then check whether the Security Fabric is enabled on the unit and which interfaces allow fabric traffic.
What to do now
- List FortiRecorder, FortiVoice and FortiWeb units and their versions.
- Upgrade to the fixed release, or migrate to a supported branch where the advisory says to.
- Apply the advisory workaround of disabling the Security Fabric if you do not use it.
- Keep fabric and management interfaces on trusted networks.
- Review administrator accounts for changes you did not make.
Why it matters
The weakness is CWE-22 (Path Traversal), in which file paths built from input escape their intended folder. In this case the record says crafted packets can lead to privilege escalation, so the path handling gives an attacker more rights than they should hold.
The medium score of 5.3 reflects the preconditions Fortinet lists. Privilege escalation on a web application firewall or a voice system is worth closing, especially when the same advisory covers a second CVE with a wider reach. Fortinet marks Known Exploited as No, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-48885.
Quick check
Which products does CVE-2024-48885 affect?
FortiRecorder, FortiVoice and FortiWeb, in the versions listed in advisory FG-IR-24-259.
What if my branch has no fix?
Fortinet says to migrate to a fixed release for FortiVoice 6.0 and FortiWeb 7.2, 7.0 and 6.4.
Sources
Last reviewed: 19 October 2026.
