{"id":"CVE-2026-106173","published":"2026-10-13T18:17:14.697","lastModified":"2026-10-14T16:04:11.750","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A path traversal vulnerability in Fortinet FortiSIEM 7.5.0 allows attackers to execute unauthorized code or commands by crafting specially formatted packets. This critical flaw enables arbitrary file access and command execution beyond the intended directory boundaries.","exploitability":"Exploitation is likely straightforward with minimal preconditions, requiring only network access to send crafted packets to the vulnerable service.","blast_radius":"The vulnerability could impact organizations using FortiSIEM 7.5.0 for security information and event management, potentially allowing attackers to execute arbitrary commands on the system with full privileges.","remediation":"Upgrade to FortiSIEM 7.5.1 or later to remediate this path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","path-traversal","network"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:07.780Z"}}