x.comadvisorydbugs (@ptdbugs) on X
CVE-2026-106173 is a critical (CVSS 9.4) unauthenticated arbitrary file write in FortiSIEM's phQueryMaster gRPC service on port 27918/TCP. The SendQueryResult method builds a path from the query-id parameter without validation, so "../" sequences escape the directory and a null byte drops the appended filename and extension. Overwriting /opt/charting/redishb.sh, which runs every 60 seconds, gives remote command execution. Horizon3.ai published the analysis and a PoC.
TL;DR Summarizes Horizon3.ai's analysis of an unauthenticated FortiSIEM gRPC path traversal that overwrites a cron-run script for RCE.
Organisations named here
- null byte injection
- phQueryMaster
- PT-2026-111783
- SendQueryResult
CVEs named here
- CVE-2026-106173
Technologies named here
- Fortinet FortiSIEM security monitoring platform
- grpc
- Redis
- CVSS
- Horizon3.ai
- FortiSIEM
Techniques named here
- Directory traversal
- Post-exploitation impact described
- Path traversal
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup