CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE

What it is

CVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service, which Fortinet advised on 13 October 2026. Horizon3 reverse-engineered it and published a root code execution chain and a proof of concept on their GitHub. The page names no affected or fixed versions.

How it works

The service is started in grpcNotificationServer::run() (libphGrpcServices.so). It takes command_port (7918), maps it to tcp/27918 through phSecureUtils::getGrpcPort(), and binds [::]:27918, so every interface is exposed. The TLS options leave client_certificate_request at GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, so a client needs no certificate.

The SendQueryResult handler builds /query/result/ plus the raw query-id with no validation, so ../ sequences choose the directory. The server still appends result-<srcIp>-<start>-<end>-<id>.dat, where <id> is a server-side counter. That limits an attacker to a directory, not a filename.

The null byte removes that limit. The server copies header values using the length the client declares, so a \0 inside query-id survives. The OS treats it as end of string when the file is opened and drops the server's suffix. The write then lands on the exact path before the null byte. Writing to an existing file overwrites it in place and keeps its owner and permissions. A second variant uses two requests to create a new file with an exact name, but the page does not describe it.

The overwrite request metadata is:

query-id:     ../../../../../opt/charting/redishb.sh\0ignored
src-ip:       127.0.0.1
period-start: 0
period-end:   0

curl and standard gRPC libraries refuse null bytes in headers, so the gRPC message has to be built by hand.

For code execution, Horizon3 overwrites /opt/charting/redishb.sh, a redis health-check script that cron runs every 60 seconds. The page says the file is writable in the admin context and gives root-level execution as the outcome.

Preconditions / Affected

• Network reach to tcp/27918 on the FortiSIEM. No credentials or client certificate are needed.
• The page lists no versions. Check Fortinet's 13 October 2026 advisory for affected and fixed builds.

What to do

The page gives no patch or mitigation steps. It gives only detection guidance:

• Fortinet and Horizon3 found no application logs that reveal exploitation.
• Inspect modification timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool. Treat any that do not match the surrounding files as suspect.
• Restricting tcp/27918 is a reasonable stopgap, but the page does not say so.

Caveats

Timestamp checks work only if the attacker overwrote an existing script and did not reset its mtime. The page does not discuss that case. phLicenseTool is listed as a file of interest without explanation.