{"id":"CVE-2026-106173","aliases":["EUVD-2026-98968","GHSA-5cx2-chqq-627m"],"status":"published","title":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in...","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions may allow attacker to execute unauthorized code or commands via specially crafted packets.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00998,"percentile":0.63209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-13T17:37:09Z","modified":"2026-11-10T20:17:32Z","exploits":[{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-106173","title":"ashrafzaryouh/CVE-2026-106173","date":"2026-10-20","url":"https://github.com/ashrafzaryouh/CVE-2026-106173"},{"source":"pocgithub","id":"horizon3ai/CVE-2026-106173","title":"horizon3ai/CVE-2026-106173","date":"2026-10-20","url":"https://github.com/horizon3ai/CVE-2026-106173"},{"source":"pocgithub","id":"tc4dy/CVE-2026-106173-PoC-Exploit","title":"tc4dy/CVE-2026-106173-PoC-Exploit","date":"2026-10-22","url":"https://github.com/tc4dy/CVE-2026-106173-PoC-Exploit"},{"source":"pocgithub","id":"aduli198/CVE-2026-106173","title":"aduli198/CVE-2026-106173","date":"2026-10-26","url":"https://github.com/aduli198/CVE-2026-106173"}],"products":[{"vendor":"fortinet","product":"fortisiem"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180"},{"url":"https://github.com/horizon3ai/CVE-2026-106173","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173"},{"url":"https://github.com/advisories/GHSA-5cx2-chqq-627m"}],"sources":{"cve":[{"id":"CVE-2026-106173","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions may allow attacker to execute unauthorized code or commands via specially crafted packets.","status":"published","published":"2026-10-13T17:37:09.9Z","modified":"2026-11-10T20:10:38.032Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T22:18:25.731086Z"}],"euvd":[{"id":"EUVD-2026-98968","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions may allow attacker to execute unauthorized code or commands via specially crafted packets.","status":"published","published":"2026-10-13T17:37:09Z","modified":"2026-11-10T20:10:38Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"critical"}],"updated_at":"2026-11-10T21:23:25.936552Z"}],"ghsa":[{"id":"GHSA-5cx2-chqq-627m","title":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in...","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","status":"published","published":"2026-10-13T18:30:57Z","modified":"2026-10-20T18:31:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:14:04.153849Z"}],"nvd":[{"id":"CVE-2026-106173","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions may allow attacker to execute unauthorized code or commands via specially crafted packets.","status":"published","published":"2026-10-13T18:17:14.697Z","modified":"2026-11-10T20:17:32.393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T22:21:29.564276Z"}]}}