CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal to Pre-Auth RCE PoC

% python3 CVE-2026-106173.py -h
usage: CVE-2026-106173.py [-h] -t TARGET [-c COMMAND] [-p PORT] [--plaintext]
                          [--dry-run]

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        IP or hostname of the FortiSIEM instance
  -c COMMAND, --command COMMAND
                        Command to execute on the target
  -p PORT, --port PORT  FortiSIEM gRPC port (default: 27918)
  --plaintext           Use HTTP/2 without TLS
  --dry-run             Display the request without sending

python3 CVE-2026-106173.py -t 10.0.18.x -c 'id'

---
id: 10333
canonical_url: "https://phying.com/item/10333"
title: "CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal to Pre-Auth RCE PoC"
type: "vulnerability"
cve: "CVE-2026-106173"
cvss: null
severity: "critical"
vendor: "Fortinet"
product: "FortiSIEM"
affected_versions: null
source_domain: "github.com"
source_url: "https://github.com/horizon3ai/CVE-2026-106173"
published_at: "2026-10-20T12:43:34Z"
snapshot_at: "2026-10-26T05:52:00Z"
archived_by: "Phying News (https://phying.com/item/10333)"
lang: "en"
---

# CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File Write RCE

*Author: Horizon3.ai Attack Team (mr-sparkles-h3) · Published: 2026-10-20 · Source: [github.com/horizon3ai/CVE-2026-106173](https://github.com/horizon3ai/CVE-2026-106173)*

This repository contains a proof of concept for **CVE-2026-106173**, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM.

## Vulnerability Details

The FortiSIEM gRPC `QueryResultReq` handler processes untrusted metadata without proper path validation. By crafting metadata containing both path traversal sequences (`../`) and NUL-byte injection within gRPC's HTTP/2 and HPACK encoding layers, an attacker can write arbitrary files to the filesystem.

## Blog Post

Technical analysis covering root cause, exploitation details, and indicators of compromise is available on the Horizon3.ai attack research blog:

[https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/](https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/)

## Usage

```bash
% python3 CVE-2026-106173.py -h
usage: CVE-2026-106173.py [-h] -t TARGET [-c COMMAND] [-p PORT] [--plaintext]
                          [--dry-run]

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        IP or hostname of the FortiSIEM instance
  -c COMMAND, --command COMMAND
                        Command to execute on the target
  -p PORT, --port PORT  FortiSIEM gRPC port (default: 27918)
  --plaintext           Use HTTP/2 without TLS
  --dry-run             Display the request without sending
```

Execute an arbitrary command:

```bash
python3 CVE-2026-106173.py -t 10.0.18.x -c 'id'
```

> **NOTE:** Execution is blind, and takes up to 60 seconds for the cron job to trigger executing the script we overwrote.

## Follow Horizon3.ai Attack Team for Latest Security Research

- [Horizon3 Attack Team (@Horizon3Attack)](https://twitter.com/Horizon3Attack)

## Disclaimer

This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers assume no liability for misuse. Use responsibly.

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10333) · Original source: [github.com](https://github.com/horizon3ai/CVE-2026-106173)