Horizon3 breaks down how CVE-2026-106173 exposes FortiSIEM to unauthenticated arbitrary file writes through gRPC path traversal and null-byte handling, leading to remote code execution.