CVE-2026-106173 in FortiSIEM
Summary
by MITRE • 10/13/2026
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical security flaw within the Fortinet FortiSIEM platform, specifically affecting version 7.5.0 and potentially earlier versions depending on patch status. This issue is classified as an improper limitation of a pathname to a restricted directory, commonly known in industry standards as Path Traversal or Directory Traversal (CWE-22). The core technical flaw lies in the application's failure to properly sanitize user-supplied input before using it to construct file system paths. When an attacker submits specially crafted packets containing maliciously formatted path sequences, such as dot-dot-slash characters combined with encoded separators, the underlying operating system interprets these inputs not as literal filenames but as instructions to navigate up the directory hierarchy or access files outside of the intended restricted scope. This lack of rigorous input validation allows the application logic to bypass security boundaries that are designed to isolate sensitive configuration files, logs, and executable binaries from unauthorized external access.
From an operational perspective, this vulnerability poses a severe risk to the integrity and confidentiality of the SIEM infrastructure. Because FortiSIEM serves as a central hub for collecting, analyzing, and storing log data from various network devices and servers, compromising its file system can lead to catastrophic consequences. An attacker who successfully exploits this path traversal flaw may be able to read sensitive configuration files that contain database credentials, API keys, or internal network topology details. More critically, if the application allows these traversed paths to interact with executable components or script interpreters, it could facilitate remote code execution (RCE). This would grant the attacker full control over the underlying operating system running FortiSIEM, enabling them to pivot into other parts of the corporate network, exfiltrate sensitive log data containing personally identifiable information or financial records, and establish persistent backdoors for long-term access.
The exploitation vector is primarily remote, meaning that an unauthenticated attacker with network connectivity to the FortiSIEM management interface can attempt this attack without needing valid user credentials initially. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter if script execution is involved, or T1203 Exploitation for Client Execution if binary payloads are delivered via the traversal mechanism. The vulnerability highlights a common weakness in web application development where dynamic file handling operations do not adequately canonicalize paths before access control checks occur. Attackers often utilize encoding techniques to bypass basic filter rules that look for obvious path separators, making this type of flaw particularly dangerous as it can evade simple signature-based detection systems if the input is sufficiently obfuscated.
To mitigate this vulnerability, immediate action must be taken by applying the official security patches provided by Fortinet for version 7.5.0 and subsequent releases. Administrators should verify that their instances are updated to a version where the path resolution logic has been hardened against traversal attacks. In addition to patching, organizations should implement network-level controls such as firewall rules or web application firewalls (WAF) to restrict access to the FortiSIEM management interface only from trusted IP addresses and administrative subnets. Input validation strategies at the application layer must be reviewed to ensure that all file path inputs are strictly validated against a whitelist of allowed characters and directories, rather than relying on blacklist approaches which can often be bypassed through encoding variations. Regular security audits and penetration testing focused on input handling and access control mechanisms will help identify similar weaknesses in other components of the SIEM ecosystem before they can be exploited by malicious actors seeking to compromise critical security monitoring infrastructure.