A critical path traversal and origin validation vulnerability in the Zurich Instruments LabOne Web Server allows unauthenticated remote attackers to access sensitive files on the host system.

The software suffers from improper limitation of a pathname to a restricted directory (CWE-22) and an origin validation error (CWE-346). These flaws permit an unauthenticated attacker to read arbitrary files accessible to the LabOne service or manipulate a victim's browser to trigger unauthorized file access.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive configuration files, credentials, or proprietary data stored on the host system. Given the CVSS 4.0 score of 7.5, this high-severity flaw poses a significant risk to data confidentiality. The ability for an unauthenticated, remote attacker to perform these actions without user interaction necessitates immediate remediation to prevent potential system compromise and data exfiltration.

Immediate Action: Update the LabOne software to version 26.01.3.9 or later, which is available via the internal update mechanism or the Zurich Instruments Download Center.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences (such as double dots) or unexpected cross-origin requests originating from untrusted domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming requests and block attempts to access directory traversal patterns, or restrict network access to the LabOne Web Server to trusted IP addresses only.

Public Exploit Available: Unknown.

The presence of path traversal and origin validation flaws in a web-facing interface presents an unacceptable risk to infrastructure security. Administrators must prioritize the deployment of the 26.01.3.9 update across all affected instances to eliminate the underlying vulnerability. If an immediate update is not feasible, restrict network access to the affected interface to authorized personnel only to minimize the attack surface.