The vulnerability is a path traversal flaw that permits an authenticated attacker to read arbitrary files on the Torrent Server accessible to the web service account. By manipulating directory‑seeking strings in a request, the attacker can bypass normal single‑user file access controls and retrieve sensitive data such as configuration files or logs. This confirms an access‑control weakness that leads to information disclosure.

The affected product is Thermo Fisher Torrent Suite Software. All users running versions prior to 5.22 are impacted; the fix is applied in 5.22 and later releases.

The CVSS score of 7.1 indicates high severity, and although an EPSS score is not provided, the absence of a known KEV listing suggests a lower but still plausible exploitation probability. The flaw can only be exploited by an attacker who obtains valid credentials for the web service account, so it requires authenticated access, likely over the network. Once authenticated, the attacker can read any file the web service account can access, potentially exposing confidential data and environment details.