{"id":"CVE-2026-107777","kind":"vulnerability","aliases":["CVE-2026-107777"],"related":[],"title":"Thermo Fisher Torrent Suite: path traversal lets authenticated users read server files","description":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.","summary":"Thermo Fisher Torrent Suite Software has a path traversal flaw that lets a logged-in user read arbitrary files on the Torrent Server. The files reachable are those the web service account can access, which may include configuration and credential files.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["self-hosted","thermo-fisher","torrent-suite","vendor"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:42+00:00","updated_at":"2026-10-25T03:36:42+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:36:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Thermo Fisher Torrent Suite: path traversal lets authenticated users read server files","impact":"medium","summary":"Thermo Fisher Torrent Suite Software has a path traversal flaw that lets a logged-in user read arbitrary files on the Torrent Server. The files reachable are those the web service account can access, which may include configuration and credential files.","category":"vendor","nicknames":[],"who_cares":["torrent-suite","thermo-fisher","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads arbitrary files the web service account can access on the server","analyst_note":"Find the vendor advisory and affected version range for Torrent Suite; the NVD entry alone gives no fixed version or check steps.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sources say the flaw affects Thermo Fisher Torrent Suite Software installations that expose the Torrent Server web service to authenticated users. The sources do not give affected versions or configuration details. Teams not running Torrent Suite can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000552,"input_tokens":3291,"output_tokens":445,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107777':15A,18A '-2026':14A,17A 'access':63B,98C 'account':61B,103C 'allow':84C 'arbitrari':47B,90C 'attack':87C 'authent':8A,86C 'configur':67B 'could':83C 'credenti':69B 'cve':13A,16A 'file':12A,48B,54B,70B,91C 'fisher':2A,24B,30B,72C 'flaw':38B 'host':21B 'includ':66B 'let':7A,40B 'log':43B 'logged-in':42B 'may':65B 'path':5A,36B,80C 'reachabl':55B 'read':10A,46B,89C 'self':20B 'self-host':19B 'server':11A,52B,95C 'servic':60B,102C 'softwar':33B,75C 'suit':4A,27B,32B,74C 'thermo':1A,23B,29B,71C 'thermo-fish':22B 'torrent':3A,26B,31B,51B,73C,94C 'torrent-suit':25B 'travers':6A,37B,81C 'user':9A,45B 'vendor':28B 'vulner':77C 'web':59B,101C","nicknames":[],"mitigations":[],"who_affected":"Sources say the flaw affects Thermo Fisher Torrent Suite Software installations that expose the Torrent Server web service to authenticated users. The sources do not give affected versions or configuration details. Teams not running Torrent Suite can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107777","severity":null,"published_at":"2026-10-16T15:17:05+00:00","modified_at":"2026-10-16T20:02:37+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}