---

Overview

This repository documents CVE-2026-106173, a reported path traversal vulnerability affecting Fortinet FortiSIEM.

Path traversal vulnerabilities occur when an application fails to properly validate file paths, potentially allowing an attacker to access resources outside an intended directory. Depending on the vulnerable component and execution context, the consequences may include unauthorized file access or further system compromise.

Disclaimer: This repository is intended for vulnerability research, defensive security, and educational purposes. Verify all technical details against the official vendor advisory before relying on them.

---

Vulnerability Information

Field	Details
CVE ID	CVE-2026-106173
Vendor	Fortinet
Product	FortiSIEM
Vulnerability Type	Path Traversal
CWE	CWE-22
Severity	Reported as Critical
CVSS	Verify the applicable score and version in the official record
Attack Vector	Reported as Network
Authentication	Reported as Not Required
Status	Investigate and verify against vendor guidance

---

Potential Impact

Depending on the affected component and deployment configuration, successful exploitation could potentially result in:

• Unauthorized access to files or resources.
• Exposure of sensitive system information.
• Compromise of system integrity.
• Further compromise of the affected environment.

Actual impact depends on the vulnerable implementation, privileges, network exposure, and applicable security controls.

---

Demo

---

Affected Versions

Consult the official vendor advisory to identify the exact affected and fixed releases.

Do not rely on version numbers copied from secondary sources without checking the vendor's current guidance.

---

Mitigation and Remediation

Recommended defensive actions:

1. Verify exposure: Identify FortiSIEM instances and determine their installed versions.
2. Apply vendor fixes: Upgrade to a release explicitly confirmed as fixed by Fortinet.
3. Restrict access: Limit management and service interfaces to trusted networks and authorized hosts.
4. Review logs: Investigate suspicious requests, unexpected file access, unusual process execution, and unexplained configuration changes.
5. Monitor activity: Look for anomalous outbound connections and other indicators of potential compromise.
6. Document remediation: Record affected assets, applied fixes, and validation results.

---

Detection and Investigation

Security teams should review available telemetry for:

• Unusual or malformed requests to exposed services.
• Unexpected file access or filesystem activity.
• Unexpected child processes or command execution.
• Authentication anomalies and configuration changes.
• Suspicious network connections originating from affected hosts.

Preserve relevant logs and evidence before performing disruptive remediation when an incident is suspected.

---

References

• Official CVE Record — CVE-2026-106173
• Fortinet PSIRT Advisories
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• NIST National Vulnerability Database

---

Disclaimer

This repository is provided for educational and defensive security purposes only. It is not affiliated with or endorsed by Fortinet.

All testing should be performed only on systems for which explicit authorization has been obtained. Vulnerability details, affected releases, severity ratings, and remediation guidance should be independently verified using authoritative sources.