EUVD-2026-75399
GHSA-h35h-27m7-j6fc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated path traversal yields arbitrary file read only, so I:N/A:N; C:H reflects full filesystem read within service-account permissions.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal.
This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5.
AnalysisAI
Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote attackers to read arbitrary files from the server filesystem via crafted HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction, and no elevated privileges are required, with high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions required - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against any network-accessible instance of GisLab Laboratory Management System versions 1.4.03 through before 1.5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score reflects genuinely high risk for affected deployments: AV:N/AC:L/PR:N/UI:N means any internet-facing instance is exploitable with minimal effort by an unauthenticated attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GisLab Laboratory Management System to version 1.5 or later, as documented in TR-CERT advisory TR-26-1063 at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1063. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all GisLab deployments running versions 1.4.03 through 1.4.x; determine whether any are internet-facing or accessible from untrusted networks, and catalog what data types are stored on affected servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allow
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated at
Authorization bypass in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows an authenticated l
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today