Read the docs
TI-2026-75329 Aliases CVE-2026-107777

Path traversal in Thermo Fisher Torrent Suite Software

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Thermo Fisher Torrent Suite Software versions 0 through 5.18 contain a path traversal flaw (CWE-22) that lets file paths escape their intended directory. An authenticated remote attacker with low privileges can read arbitrary files on the Torrent Server that the web service account can access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed Torrent Suite Software (Thermo Fisher): 5.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Thermo FisherTorrent Suite Softwareup to 5.185.22Patch availableCNA
  • Torrent Suite Software VendorThermo Fisher Affected up to 5.18 Fixed in 5.22 Patch available CNA

Remediation

Upgrade Thermo Fisher Torrent Suite Software to version 5.22.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Torrent Suite Software (Thermo Fisher) Fixed in 5.22

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-107777
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2017-08222 dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and… CVSS 3.1CRITICAL 9.8
  • TI-2025-34132 An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. CVSS 3.1CRITICAL 9.8
  • TI-2025-34131 The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials… CVSS 3.1CRITICAL 9.8
  • TI-2025-33819 An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. CVSS 3.1CRITICAL 9.8
  • TI-2017-08387 dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for… CVSS 3.1CRITICAL 9.8
  • TI-2025-34135 An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences