(horizon3.ai) Critical Arbitrary File Write Vulnerability in Fortinet FortiSIEM (CVE-2026-106173): Exploiting gRPC for Unauthenticated Code Execution In brief - This article analyzes CVE-2026-106173, a critical vulnerability in Fortinet's FortiSIEM that allows an unauthenticated attacker to perform arbitrary file writes. The researchers demonstrate how this flaw can be leveraged to achieve remote code execution by overwriting system scripts. Technically - This article details a vulnerability in the phQueryMaster gRPC service listening on tcp/27918, which lacks client certificate authentication. The flaw exists in the SendQueryResult method, where the 'query-id' parameter is concatenated into a file path without validation, enabling path traversal. By embedding a null byte (\0) in the 'query-id' string, an attacker can truncate the server-appended filename suffix, gaining exact control over the target file path. The researchers achieved remote code execution by overwriting the /opt/charting/redishb.sh script, which is executed every 60 seconds via a cron job. Source: https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/ #Cybersecurity