Horizon3.ai has published a proof-of-concept exploit for CVE-2026-106173, a critical path-traversal flaw in Fortinet's FortiSIEM platform that Fortinet patched last week. Fortinet's advisory FG-IR-26-180 describes an improper limitation of a pathname to a restricted directory (CWE-22) that lets an unauthenticated attacker execute unauthorised code or commands via specially crafted packets; FortiSIEM 7.6 is not affected and 7.5.0 users must move to 7.5.1 or above. Horizon3 says an attacker connects to the gRPC service listening on TCP port 27918 and abuses unsafe path construction in the SendQueryResult() handler, which passes a user-supplied query-id into a file path without validation. Traversal alone cannot choose a file name because the server appends result--0-0-.dat, so Horizon3 embeds a NUL byte in query-id to truncate that suffix, overwriting an existing file in place — its example rewrites a Redis health-check shell script that cron executes every 60 seconds, turning an arbitrary file write into remote code execution. Fortinet records no known exploitation; the PoC is the exposure.

• Source article