Critical Severity
CVE-2026-106173
Published: Oct 25, 2026
CVE-2026-106173 – FortiSIEM phQueryMaster RCE (CVSS 9.8) | Red/Blue Team suite for unpatched FortiSIEM 7.5.0. 2 tools: Full Exploit (multi-primitive RCE, reverse shell, persistence, creds, readback, mass scan, Tor), Blue Team Checker (exposure detection, HTTP/2 fingerprint, reporting, audit). Only Use Ethically, Stay Legal <3
# CVE‑2026‑106173 – FortiSIEM phQueryMaster File Write Toolkit
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[](https://github.com/tc4dy)
[](https://www.fortinet.com/products/siem/fortisiem)
> **ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING**
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
---
## Vulnerability Overview
**CVE‑2026‑106173** is a critical unauthenticated arbitrary file write vulnerability in Fortinet FortiSIEM **7.5.0** that can be escalated to remote code execution as **root** via a file-system path traversal and NUL byte injection in the `phQueryMaster` gRPC service.
### How it works
1. **Unauthenticated gRPC access** – the `phQueryMaster` gRPC service binds to `[::]:27918` and is configured with `GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE`. No client certificate is required.
2. **Path traversal** – the `SendQueryResult` RPC handler concatenates the attacker-controlled `query-id` metadata value directly into a file path (`/query/result/<query-id>`), allowing `../../` traversal out of the intended directory.
3. **NUL byte injection** – because the server preserves the exact length of the client-supplied metadata, a NUL byte (`\x00`) can be embedded in `query-id`. The filesystem call truncates at the NUL, giving full control over the final file name (the server-appended `result-...-.dat` suffix is silently dropped).
4. **File write** – the base64/raw content of the `file_content` protobuf field is written to