- Critical path traversal vulnerability CVE-2026-106173 in Fortinet FortiSIEM carries a CVSS score of 9.4 and can be exploited remotely without authentication.
- Horizon3.ai has released a proof-of-concept exploit that combines directory traversal and null-byte injection to achieve arbitrary file write and remote code execution.
- Patches are available in FortiSIEM version 7.5.1; version 7.6 is not affected.
Cybersecurity researchers at Horizon3.ai have released a proof-of-concept exploit for a critical flaw in Fortinet FortiSIEM, designated CVE-2026-106173 with a CVSS score of 9.4. The vulnerability enables an unauthenticated attacker to execute unauthorized code via specially crafted packets targeting the gRPC service on TCP port 27918.
Patches were issued last week for FortiSIEM version 7.5.0, which must be upgraded to 7.5.1 or above, while version 7.6 is not affected. According to Horizon3.ai, the gRPC QueryResultReq handler processes untrusted metadata without proper path validation, allowing an attacker to embed path traversal sequences and NUL-byte injection within gRPC’s HTTP/2 and HPACK encoding layers.
The problem originates in the SendQueryResult() function, which passes a user-supplied “query-id” parameter without sufficient validation. By including directory traversal sequences like “../”, an attacker can escape the intended directory, though the program appends a fixed file name such as “result-
A second weakness enables null-byte injection into the same parameter: embedding “\0” causes the operating system to treat it as a string terminator, discarding the appended suffix. An attacker can craft a “query-id” value like “../../../../../opt/charting/redishb.sh\0…” to overwrite a shell script that performs health checks on Redis and runs every 60 seconds via a cron job.
“The write lands on the exact path that preceded the null byte,” said Zach Hanley, Chief Attack Engineer at Horizon3.ai. “Pointed at an existing file, this overwrites it in place, keeping the original owner and permissions; a second variant uses two requests to create a brand-new file with an exact name.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
