{"id":"CVE-2026-106173","published":"2026-10-13T18:17:14Z","modified":"2026-10-21T04:17:07Z","title":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"description":{"text":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw (CWE: improper limitation of a pathname to a restricted directory) in Fortinet FortiSIEM 7.5.0 lets an attacker escape the directory the software is meant to confine file access to. The attacker can execute unauthorized code or commands by sending specially crafted packets to the affected component.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00998,"percentile":0.62705,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-23","exploitedFirstSeen":"2026-10-23","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-106173","date":"2026-10-23"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6acf987fa92372976a324f03","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","tags":[]},{"url":"https://github.com/horizon3ai/CVE-2026-106173","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98968","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98968","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-10-20","earliestUrl":"https://github.com/horizon3ai/CVE-2026-106173","repos":[{"name":"horizon3ai/CVE-2026-106173","url":"https://github.com/horizon3ai/CVE-2026-106173","stars":35,"created":"2026-10-20"},{"name":"tc4dy/CVE-2026-106173-PoC-Exploit","url":"https://github.com/tc4dy/CVE-2026-106173-PoC-Exploit","stars":5,"created":"2026-10-22"},{"name":"0xredash/CVE-2026-106173","url":"https://github.com/0xredash/CVE-2026-106173","stars":2,"created":"2026-10-20"},{"name":"MRdark-ops/rce-FortiSIEM","url":"https://github.com/MRdark-ops/rce-FortiSIEM","stars":2,"created":"2026-10-23"},{"name":"aduli198/CVE-2026-106173","url":"https://github.com/aduli198/CVE-2026-106173","stars":0,"created":"2026-10-26"}]},"first":{"date":"2026-10-20","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2026-106173"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","provenance":"source"},{"date":"2026-10-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2026-106173","provenance":"source"},{"date":"2026-10-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-106173","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 8 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.54,"detail":"percentile 0.6270"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}