CVE-2026-107777

waiting for further signals

GHSA-5qx4-xffp-qv95 ↗EUVD-2026-102896 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Thermo Fisher Torrent Suite Software <= 5.18

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ETK-2026-2223, permanent identifier

cvss7.1cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

9h 22msince last run

55mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+103h05m

+2h

+4h

+6h

+8h

+10h

description

Thermo Fisher Torrent Suite Software is affected by a path traversal vulnerability. An authenticated attacker may read files on the Torrent Server that are accessible to the web-service account.

mitigation

Restrict access to the Torrent Suite web interface to trusted, authorized users and networks, and ensure its service account has only the file permissions it requires. Apply a vendor-provided update when one is published; no fixed version is recorded in the advisory.

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

–

agent run time

55m

cve.org record, t = 0

2026-10-16 14:40Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-16 14:40Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-107777

this entry in the feed

GET /api/v1/feed/CVE-2026-107777

{
  "etk_id": "ETK-2026-2223",
  "cve_id": "CVE-2026-107777",
  "display_id": "CVE-2026-107777",
  "ghsa_id": "GHSA-5qx4-xffp-qv95",
  "euvd_id": "EUVD-2026-102896",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated path traversal in Torrent Suite Software",
  "summary": "Thermo Fisher Torrent Suite Software is affected by a path traversal vulnerability. An authenticated attacker may read files on the Torrent Server that are accessible to the web-service account.",
  "mitigation": "Restrict access to the Torrent Suite web interface to trusted, authorized users and networks, and ensure its service account has only the file permissions it requires. Apply a vendor-provided update when one is published; no fixed version is recorded in the advisory.",
  "vendor": "Thermo Fisher",
  "product": "Torrent Suite Software",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.18"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Torrent Suite Software",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.33456486666667,
  "t0_at": "2026-10-16T14:40:20.840000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T14:40:20.840000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:40:20.840000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107777"
    }
  }
}

published 2026-10-20 20:49Z
last change 2026-10-21 06:34Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.