Executive brief
Zurich Instruments LabOne, a software suite used to control scientific measurement hardware, contains a security flaw in its web-based user interface. An attacker could exploit this to remotely read sensitive files from the computer running the software without needing a password. This could lead to the theft of research data, system credentials, or other private information stored on the host machine.
Technical details
A path traversal vulnerability (CWE-22) exists in the LabOne Web Server's file access functionality due to insufficient input validation. An unauthenticated attacker can exploit this via the network to access any files on the host operating system that the LabOne process has permissions to read. Additionally, an origin validation error (CWE-346) allows for a secondary attack vector where a remote attacker can use a malicious website to trigger file access through a victim's browser. The vulnerability only affects systems where the LabOne Web Server component is active; API-only installations are not impacted. Zurich Instruments has released version 26.01.3.9 to address the issue.
Affected products
- Zurich Instruments LabOne all versions prior to 26.01.3.9
Timeline
- 2026-04-22: disclosed: Initial internal discovery and advisory publication (V1.0)
- 2026-04-23: advisory: Updated advisory (V1.1) with CVE-2026-6903 identifier
- 2026-04-23: patched: LabOne 26.01.3.9 released to address the vulnerability