Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

GisLab lets attackers view files outside allowed folders

CVE-2026-9166 · published 1 month ago
Summary

Versions of the GisLab Laboratory Management System before 1.5 let a user craft a request that moves outside the intended directory and reads any file the server can access. This could expose sensitive data such as configuration details or private records. Upgrade to version 1.5 or later, or apply the vendor's recommended patch, to stop the file‑access risk.

What to do
  • Update gis informatics gislab laboratory management system to version 1.5 or later.
Affected software
VendorProductAffected versions
gis informatics gislab laboratory management system < 1.5
Original advisory text
LFI in GIS Informatics' GisLab Laboratory Management System
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal.

This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Sep 2026
Updated4 Nov 2026
First seen10 Sep 2026
Sources
CVE-2026-9166 · NVD
CVE-2026-9166 · MITRE
Track software like this
Free during beta