CVE-2026-9166: LFI in GIS Informatics' GisLab Laboratory Management System
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal.
This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GIS Informatics GisLab Laboratory Management Systemto a version that resolves this vulnerability.Fixed in 1.5
Event History
Frequently Asked Questions
Which deployments are affected?
GisLab Laboratory Management System versions from 1.4.03 up to, but not including, 1.5 are affected.
Can this be exploited remotely without authentication or user interaction?
Yes. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely impact of successful exploitation?
Successful path traversal can result in high confidentiality impact. The supplied metrics indicate no integrity or availability impact.