Fortinet Forticlient EMS RCE CVE-2025-59922 and one IMG tag to rule them all

Introduction Recently we dived into Fortinet EMS for vulnerability research, as we like to use our spare time to hone skills and keep customers safe by addressing zero-days. We succeeded in chaining a simple img tag into a fully fledged remote code execution. This is not a 0-click pop the …