EUVD-2026-102896
GHSA-5qx4-xffp-qv95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege web account
-
DeliverySend request with traversal sequence
-
ExploitBypass path restriction in parser
-
ExecutionRead arbitrary files as web service account
-
ImpactExfiltrate sensitive data/credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on the Torrent Suite Software web service (CVSS PR:L), after which the attacker abuses a file-path parameter vulnerable to directory traversal (CWE-22) to read files accessible to the web service account. The scope of readable data is limited to whatever filesystem permissions the web service account holds - it cannot read files outside that account's access, and it provides no write, code-execution, or integrity impact. The primary limiting factor is the authentication prerequisite; this is not a remote-unauthenticated flaw, so realistic risk is confined to insiders or attackers who have already acquired low-privilege credentials. |
| Impact | This is a moderate-priority information-disclosure flaw, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low-level authentication, with high confidentiality impact (VC:H) but zero integrity or availability impact (VI:N/VA:N) and no scope change (SC:N/SI:N/SA:N), yielding a 7.1 (High) score driven almost entirely by the read-anything-the-web-account-can capability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not conflict, they are simply absent. The PR:L requirement is a meaningful limiter: an attacker must first hold a valid (even low-privilege) account on the Torrent Suite web interface, which bounds exposure to insiders or attackers who have already obtained credentials. Net: treat as a standard patch-on-cycle item for affected genomics lab environments rather than an emergency, while recognizing that arbitrary file read can expose credentials/config that enable follow-on escalation. |
| Exploit ScenarioDerived | An attacker holding low-privilege credentials to the Torrent Suite web interface sends a crafted request manipulating a file-path parameter with directory-traversal sequences, causing the web service to return files outside the intended directory. They retrieve sensitive files readable by the web service account - configuration files, credentials, or patient/genomic data - enabling further compromise. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.
Earlier versions of this analysis (1)
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid account on the Torrent Server web interface read arbitrary files on the underlying filesystem, limited only by the permissions of the web service account. The flaw is network-reachable with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), and the practical exposure depends on how broadly the web service account is granted read access to instrument, run, and configuration data. This is a moderate-severity information-disclosure issue rather than an emergency: exploitation requires prior authentication, so no public exploit has been identified at time of analysis, and there is no CISA KEV listing or vendor-confirmed active exploitation.
RemediationAI
No vendor-released patch version is specified anywhere in the available intelligence, so treat patch status as unconfirmed and obtain the authoritative fixed-build information directly from Thermo Fisher and from CISA's ICS medical advisory ICSMA-26-288-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01); the associated CSAF file (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-01.json) should be monitored for updates, and the vendor product guide (https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf) documents supported deployment configurations. Until a fix is applied, the most effective compensating control is to segment and restrict network access to the Torrent Server web interface so it is reachable only from trusted laboratory VLANs or management hosts - the trade-off is reduced convenience for remote or distributed lab staff, which is usually acceptable because this is an internal instrument-management service. Second, ensure the Torrent Suite web service runs under a dedicated, minimally privileged service account whose filesystem read access excludes credential stores, backup archives, and unrelated directories; this does not remove the traversal flaw but caps what a successful exploit can disclose. Third, rotate any credentials or keys that happen to live within the web service account's readable paths and audit HTTP logs for encoded traversal sequences (../, %2e%2e%2f) or unexpected file-path parameter values, since exploitation is authenticated and therefore leaves a session trail that can be correlated to a user account. Finally, because the flaw requires a valid session, tightening authentication hygiene - unique accounts, strong passwords or MFA where the product supports it, and prompt revocation of stale accounts - directly reduces the attack surface while the vendor fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying weakness is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal), rooted in insufficient canonicalization and validation of a user-supplied file-path parameter in the Torrent Suite Software web service. Because the software is a laboratory/medical instrument management platform used with Thermo Fisher Ion Torrent next-generation sequencing instruments (the CPE string cpe:2.3:a:thermo_fisher:torrent_suite_software:*:*:*:*:*:*:*:* indicates all versions of the product are treated as affected), the web service account typically has read access to instrument configuration, run data, sample metadata, and potentially log or credential material on the Torrent Server host. An attacker who can inject sequences such as ../ into the vulnerable path parameter causes the server to resolve the request outside its intended data directory and return the contents of the target file. The CVSS 4.0 base of 7.1 with VC:H and no VI/VA reflects a pure confidentiality breach; the assessed CVSS 3.1 equivalent (PR:L, S:U, C:H/I:N/A:N) confirms the flaw is not remotely unauthenticated, provides no scope change, and cannot be leveraged for lateral movement beyond the web service account's own permissions. The CWE class also implies that standard mitigations - canonical path resolution, allow-listing of permitted directories, and running the service under a tightly restricted account - directly address the root cause.
Know when Torrent Suite Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable web service (AV:N), no special conditions (AC:L), requires a low-privilege authenticated account (PR:L), arbitrary file read gives high confidentiality but no integrity/availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.
Executive ViewAI
Thermo Fisher Torrent Suite Software, used to manage Torrent Server web-interface workflows, contains an authenticated path-traversal flaw that could allow a low-privilege user to read files accessible to the web service account. Because exploitation requires valid credentials and affects only confidentiality, the immediate organizational risk centers on insider misuse or compromised low-privilege accounts rather than remote unauthenticated attack. Leadership should care because no vendor-released patch is identified, the issue is covered by a CISA medical advisory, and exposed sensitive files could create privacy, compliance, or research-integrity concerns until mitigations are implemented.
Restrict Torrent Server web-interface access to trusted networks or VPN, enforce least privilege and MFA for web accounts, limit the web service account's filesystem read permissions, disable unused accounts, segment or isolate affected systems, enable and monitor access logs for anomalous file reads, and apply vendor mitigations or patch when released.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Torrent Suite Software
View allA remote code execution vulnerability in Thermo Fisher Torrent Suite Django application 5.18.1 (CVSS 9.8). Critical seve
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/uplo
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerabil
Exploit-DB