Public PoC for CVE-2026-106173 Enables Unauthenticated RCE on FortiSIEM via gRPC Path Traversal

The flaw sits in SendQueryResult() inside the gRPC QueryResultReq handler. User-controlled query-id metadata is concatenated into a file path without sanitization. An attacker supplies ../ sequences plus a null byte to truncate the server-appended suffix, landing a write directly on the health-check script that runs every 60 seconds.

Horizon3 demonstrated two variants: in-place overwrite of the existing script while preserving owner and permissions, and creation of a new file with an arbitrary name using two sequential requests. Both succeed against FortiSIEM 7.5.0; 7.6 and later are unaffected. No authentication or prior session is required.

Fortinet issued patches last week, yet the public PoC lowers the bar from theoretical to immediate. Historical Fortinet disclosures show delayed patch adoption on SIEM appliances that sit on management networks; the same pattern is likely here because FortiSIEM instances are rarely exposed to routine external scanning.

Operators should inventory every 7.5.0 deployment, confirm the gRPC listener is not reachable from untrusted segments, and monitor for unexpected writes to redishb.sh. Continued use of unpatched versions after the PoC date creates a measurable window for opportunistic compromise.