CVE-2026-6903

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6903", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-04-23T09:44:28.397Z", "datePublished": "2026-04-23T09:45:06.146Z", "dateUpdated": "2026-04-23T12:06:00.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-04-23T09:45:06.146Z"}, "title": "Path Traversal Vulnerability in LabOne User Interface", "datePublic": "2026-04-22T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error", "type": "CWE"}]}], "affected": [{"vendor": "Zurich Instruments", "product": "LabOne", "versions": [{"status": "affected", "version": "0", "lessThan": "26.01.3.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.\n\nAdditionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.\n\nThe vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.</p><p>Additionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.</p><p>The vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.</p>"}]}], "references": [{"url": "https://www.zhinst.com/support/security/2026/zi-sa-2026-001/", "tags": ["vendor-advisory"]}, {"url": "https://www.zhinst.com/support/download-center/", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Upgrading to LabOne 26.01.3.9 or later is the only complete remediation. For customers who cannot upgrade immediately, the following workarounds reduce the risk and should be applied together:\n\nAgainst a same-network attacker (an actor on the same network connecting directly to the LabOne Web Server):\n\n- Configure a local firewall to limit access to the LabOne Web Server (default port 8006) to localhost only, preventing access from other hosts on the network.\n\n- Operate systems running LabOne only within a dedicated, trusted laboratory network that is not connected to the general corporate network or the internet.\n\nAgainst a malicious-website attacker (a user visits an untrusted website while the LabOne Web Server is running, and the website triggers the vulnerable behaviour through the user's browser):\n\n- Do not browse untrusted or unknown websites on systems where the LabOne Web Server is active. Where practical, dedicate the LabOne host to instrument control only and avoid general-purpose web browsing on it.\n\nAdditional risk reduction: For systems that cannot be upgraded, avoiding the storage of credentials, personal data, or sensitive research data on the LabOne host reduces the impact of a successful exploit.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrading to LabOne 26.01.3.9 or later is the only complete remediation. For customers who cannot upgrade immediately, the following workarounds reduce the risk and should be applied together:</p><p>Against a same-network attacker (an actor on the same network connecting directly to the LabOne Web Server):</p><p>- Configure a local firewall to limit access to the LabOne Web Server (default port 8006) to localhost only, preventing access from other hosts on the network.</p><p>- Operate systems running LabOne only within a dedicated, trusted laboratory network that is not connected to the general corporate network or the internet.</p><p>Against a malicious-website attacker (a user visits an untrusted website while the LabOne Web Server is running, and the website triggers the vulnerable behaviour through the user's browser):</p><p>- Do not browse untrusted or unknown websites on systems where the LabOne Web Server is active. Where practical, dedicate the LabOne host to instrument control only and avoid general-purpose web browsing on it.</p><p>Additional risk reduction: For systems that cannot be upgraded, avoiding the storage of credentials, personal data, or sensitive research data on the LabOne host reduces the impact of a successful exploit.</p>"}]}], "solutions": [{"lang": "en", "value": "Update to LabOne 26.01.3.9 or later. The update can be applied directly through the LabOne software, or downloaded from the Zurich Instruments Download Center at https://www.zhinst.com/support/download-center.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update to LabOne 26.01.3.9 or later. The update can be applied directly through the LabOne software, or downloaded from the Zurich Instruments Download Center at https://www.zhinst.com/support/download-center.</p>"}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T12:05:04.376816Z", "id": "CVE-2026-6903", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T12:06:00.172Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6903", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T12:05:04.376816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T12:05:56.110Z"}}], "cna": {"title": "Path Traversal Vulnerability in LabOne User Interface", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zurich Instruments", "product": "LabOne", "versions": [{"status": "affected", "version": "0", "lessThan": "26.01.3.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to LabOne 26.01.3.9 or later. The update can be applied directly through the LabOne software, or downloaded from the Zurich Instruments Download Center at https://www.zhinst.com/support/download-center.", "supportingMedia": [{"type": "text/html", "value": "<p>Update to LabOne 26.01.3.9 or later. The update can be applied directly through the LabOne software, or downloaded from the Zurich Instruments Download Center at https://www.zhinst.com/support/download-center.</p>", "base64": false}]}], "datePublic": "2026-04-22T00:00:00.000Z", "references": [{"url": "https://www.zhinst.com/support/security/2026/zi-sa-2026-001/", "tags": ["vendor-advisory"]}, {"url": "https://www.zhinst.com/support/download-center/", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Upgrading to LabOne 26.01.3.9 or later is the only complete remediation. For customers who cannot upgrade immediately, the following workarounds reduce the risk and should be applied together:\n\nAgainst a same-network attacker (an actor on the same network connecting directly to the LabOne Web Server):\n\n- Configure a local firewall to limit access to the LabOne Web Server (default port 8006) to localhost only, preventing access from other hosts on the network.\n\n- Operate systems running LabOne only within a dedicated, trusted laboratory network that is not connected to the general corporate network or the internet.\n\nAgainst a malicious-website attacker (a user visits an untrusted website while the LabOne Web Server is running, and the website triggers the vulnerable behaviour through the user's browser):\n\n- Do not browse untrusted or unknown websites on systems where the LabOne Web Server is active. Where practical, dedicate the LabOne host to instrument control only and avoid general-purpose web browsing on it.\n\nAdditional risk reduction: For systems that cannot be upgraded, avoiding the storage of credentials, personal data, or sensitive research data on the LabOne host reduces the impact of a successful exploit.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrading to LabOne 26.01.3.9 or later is the only complete remediation. For customers who cannot upgrade immediately, the following workarounds reduce the risk and should be applied together:</p><p>Against a same-network attacker (an actor on the same network connecting directly to the LabOne Web Server):</p><p>- Configure a local firewall to limit access to the LabOne Web Server (default port 8006) to localhost only, preventing access from other hosts on the network.</p><p>- Operate systems running LabOne only within a dedicated, trusted laboratory network that is not connected to the general corporate network or the internet.</p><p>Against a malicious-website attacker (a user visits an untrusted website while the LabOne Web Server is running, and the website triggers the vulnerable behaviour through the user's browser):</p><p>- Do not browse untrusted or unknown websites on systems where the LabOne Web Server is active. Where practical, dedicate the LabOne host to instrument control only and avoid general-purpose web browsing on it.</p><p>Additional risk reduction: For systems that cannot be upgraded, avoiding the storage of credentials, personal data, or sensitive research data on the LabOne host reduces the impact of a successful exploit.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.\n\nAdditionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.\n\nThe vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.", "supportingMedia": [{"type": "text/html", "value": "<p>The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.</p><p>Additionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.</p><p>The vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-04-23T09:45:06.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6903", "state": "PUBLISHED", "dateUpdated": "2026-04-23T12:06:00.172Z", "dateReserved": "2026-04-23T09:44:28.397Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-04-23T09:45:06.146Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LabOne", "vendor": "Zurich Instruments", "versions": [{"lessThan": "26.01.3.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.\n\nAdditionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.\n\nThe vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed."}, {"lang": "es", "value": "El servidor web LabOne, que respalda la interfaz de usuario de LabOne, contiene validaci\u00f3n de entrada insuficiente en su funcionalidad de acceso a archivos. Un atacante no autenticado podr\u00eda explotar esta vulnerabilidad para leer archivos arbitrarios en el sistema anfitri\u00f3n que son accesibles para el usuario del sistema operativo que ejecuta el software LabOne.\n\nAdem\u00e1s, el servidor web no restringe suficientemente las solicitudes de origen cruzado, lo que podr\u00eda permitir a un atacante remoto activar el acceso a archivos desde el navegador de una v\u00edctima al dirigir a la v\u00edctima a un sitio web malicioso.\n\nLa vulnerabilidad solo es explotable cuando el servidor web LabOne est\u00e1 en ejecuci\u00f3n. Las instalaciones que utilizan solo las API de LabOne sin iniciar el servidor web no est\u00e1n expuestas."}], "id": "CVE-2026-6903", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6903", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T12:05:04.376816Z", "version": "2.0.3"}}]}, "published": "2026-04-23T10:16:18.680", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://www.zhinst.com/support/download-center/"}, {"source": "vulnerability@ncsc.ch", "url": "https://www.zhinst.com/support/security/2026/zi-sa-2026-001/"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-346"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.01.3.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LabOne", "source": "cna", "vendor": "Zurich Instruments"}, "product": "labone", "vendor": "zurich_instruments"}], "analysis": {"en": {"generated_at": "2026-04-28T14:55:17.348074+00:00", "value": {"mitigation_remediation": ["Update LabOne to version 26.01.3.9 or later using the built\u2011in update function or by downloading the patch from Zurich Instruments.", "If an update cannot be applied immediately, block external access to the LabOne Web Server (port\u202f8006) by configuring the local firewall to accept connections only from localhost.", "Run LabOne only on a dedicated, trusted laboratory network that is isolated from the general corporate network and the Internet.", "Avoid browsing untrusted websites on any system that has the LabOne Web Server running, or dedicate the host machine solely for instrument control.", "For systems that cannot be upgraded or isolated, refrain from storing credentials, personal data, or sensitive research data on the LabOne host to reduce the impact of a successful exploit."], "summary": {"action": "Patch Immediately", "impact": "Remote File Disclosure"}, "threat_synthesis": {"affected_systems": "All Zurich Instruments LabOne installations that include the embedded Web Server component and are running a version prior to 26.01.3.9. The specified fix applies to these releases; installations that have upgraded to 26.01.3.9 or later are considered protected.", "description_and_impact": "The LabOne Web Server lacks sufficient input validation in its file access functionality. An unauthenticated attacker can supply directory\u2011traversal sequences to read arbitrary files on the host that the operating system user running LabOne can access. In addition, the server does not properly restrict cross\u2011origin requests, allowing a remote attacker to trigger malicious file requests from a victim\u2019s browser. This weakness corresponds to path traversal (CWE\u201122) and insufficient cross\u2011origin protection (CWE\u2011346).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.7, indicating high severity, while the EPSS score of less than 1\u202f% reflects a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation requires that the Web Server be running and requires no authentication. The likely attack vectors include an attacker on the same internal network or a malicious website that a user visits while the LabOne host\u2019s Web Server is active, both capable of triggering the vulnerable file\u2011access behavior. Successful exploitation would allow an attacker to read any files readable by the LabOne OS user, potentially compromising confidential or sensitive data."}}}}, "created": "2026-04-28T09:26:09.478434+00:00", "updated": "2026-04-28T15:00:14.523510+00:00", "vendors": ["zurich_instruments", "zurich_instruments$PRODUCT$labone"]}