FortiSIEM: Remote Command Execution via Directory Traversal

Researchers Horizon3.ai have published a technical analysis of the critical vulnerability CVE-2026-106173 in Fortinet's FortiSIEM security monitoring platform. The flaw affects the phQueryMaster gRPC service, accessible on port 27918/TCP, and allows an unauthenticated user to write arbitrary files to the server's file system. The vulnerability received a CVSS score of 9.4.

To exploit the vulnerability, an attacker calls the SendQueryResult method, which saves query results to files. The query-id parameter is used to construct the path without proper validation, allowing ../ sequences to be used to escape the intended directory. The researchers also discovered that a null byte \0 can be injected, allowing the attacker to bypass the automatic addition of the filename and extension. As a result, an attacker can overwrite an existing executable script, such as /opt/charting/redishb.sh, which runs automatically every 60 seconds to check the status of Redis.

Exploiting the vulnerability allows an attacker to execute arbitrary commands on the FortiSIEM server without authentication. This enables access to configuration files and other data accessible to the process, disruption of the monitoring system, and further attacks within the internal network.

Article: https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/

PoC: https://github.com/horizon3ai/CVE-2026-106173