# CVE-2025-54307: An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The…

Source: https://junglewise.ai/threats/cve-2025-54307-an-issue-was-discovered-in-the-thermo-fisher-torrent-suite-django  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-04  
License: CC BY 4.0 with a link back

CVE-2025-54307 · Severity: high · CVSS 8.8 · Published 2025-12-04

An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offline/bundle/upload/ endpoints allow low-privilege users to upload ZIP files to the server. The plupload_file_upload function handles these file uploads and constructs the destination file path by using either the name parameter or the uploaded filename, neither of which is properly sanitized. The file extension is extracted by splitting the filename, and a format string is used to construct the final file path, leaving the destination path vulnerable to path traversal. An authenticated attacker with network connectivity can write arbitrary files to the server, enabling remote code execution after overwriting an executable file. An example is the pdflatex executable, which is executed through subprocess.Popen in the write_report_pdf function after requests to a /report/latex/(\d+).pdf endpoint.

Technologies: [Thermofisher Torrent Suite Software](https://junglewise.ai/threats/technologies/thermofisher-torrent-suite-software). Vendors: [Thermofisher](https://junglewise.ai/threats/vendors/thermofisher).

## Quick answers

**Is CVE-2025-54307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54307 being exploited in the wild.

**How severe is CVE-2025-54307?** High severity, with a CVSS score of 8.8, published 4 December 2025.

**Which products and versions are affected?** Thermofisher Torrent Suite Software. The advisory does not name versions.

**Is there a fix for CVE-2025-54307?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-54307?** Check whether you run Thermofisher Torrent Suite Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Thermofisher Torrent Suite Software

## Related threats

- [An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution…](https://junglewise.ai/threats/cve-2025-54306-an-issue-was-discovered-in-the-thermo-fisher-torrent-suite-django)
- [An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included…](https://junglewise.ai/threats/cve-2025-54305-an-issue-was-discovered-in-the-thermo-fisher-torrent-suite-django)
- [The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API.](https://junglewise.ai/threats/cve-2025-54303-the-thermo-fisher-torrent-suite-django-application-5-18-1-has)