Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.

Patches for the flaw were released last week by Fortinet in the following versions -

According to Horizon3.ai, the issue involves an unauthenticated attacker connecting to the gRPC service listening on TCP port 27918 and exploiting the flaw to overwrite an existing file outside of the intended directory and turn the arbitrary-file-write primitive into remote code execution.

"The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation," Horizon3.ai said. "By crafting metadata containing both path traversal sequences (../) and NUL-byte injection within gRPC's HTTP/2 and HPACK encoding layers, an attacker can write arbitrary files to the file system."

The problem stems from a case of unsafe path construction within a function named SendQueryResult(), which passes a user-supplied "query-id" parameter directly without sufficient validation.

In other words, an attacker can leverage this flaw to include directory traversal sequences such as "../" and escape that directory. However, this only allows an attacker to navigate to a directory of their choice and write to it, but not to opt for a file name because the program automatically adds its own file name "result-<source IP address>-0-0-<id>.dat," where <id> is a counter value controlled by the server.

Source link