Zurich Instruments LabOne Path Traversal Vulnerability Advisory (ZI-SA-2026-001)

Vulnerability Summary: ZI-SA-2026-001 Vulnerability Overview Vulnerability Name: Path Traversal Vulnerability in LabOne User Interface Vulnerability ID: ZI-SA-2026-001 CVSS Score: v3.1 Base Score 7.5 (High); v4.0 Base Score 8.7 (High) Vulnerability Description: The LabOne Web Server has insufficient input validation in its file access functionality. Unauthorized attackers can exploit this vulnerability to read arbitrary files accessible by the operating system user on the host system. In addition, the Web Server does not sufficiently restrict cross-origin requests, which may allow remote attackers to trigger file access via a browser. Exploitation Conditions: Exploitable only when the LabOne Web Server is running. Installations that use only the LabOne API without starting the Web Server are not affected. Impact Scope Affected Products: LabOne Affected Versions: All versions earlier than 26.01.3.9. Attack Vectors: 1. Same-network attacker: An attacker directly connected to the LabOne Web Server. 2. Malicious website attacker: A user visits an untrusted website while using the LabOne Web Server, thereby triggering the vulnerability. Remediation Recommended Fix: Upgrade to LabOne 26.01.3.9 or later. Upgrade Method: Update directly through the LabOne software, or download from the Zurich Instruments Download Center. Temporary Mitigations (Workarounds and Mitigations) If immediate upgrade is not possible, consider the following measures to reduce risk: 1. For same-network attackers: Configure local firewall rules to restrict access to the LabOne Web Server (default port 8006), allowing only and blocking access from other hosts. Run LabOne only in a dedicated, trusted laboratory network that should not be connected to general enterprise networks or the internet. 2. For malicious website attackers: Do not browse untrusted or unknown websites on systems running the LabOne Web Server. Where feasible, dedicate the LabOne host solely for instrument control and avoid general web browsing on it. 3. Other Recommendations: For systems that cannot be upgraded, avoid storing credentials, personal data, or sensitive research data to minimize impact if exploitation occurs. Follow general security best practices by restricting network access, allowing only trusted users and networks to reach systems running the affected version of LabOne.

Goal Reached Thanks to every supporter — we hit 100%!

Zurich Instruments LabOne Path Traversal Vulnerability Advisory (ZI-SA-2026-001)