The LabOne Web Server lacks sufficient input validation in its file access functionality. An unauthenticated attacker can supply directory‑traversal sequences to read arbitrary files on the host that the operating system user running LabOne can access. In addition, the server does not properly restrict cross‑origin requests, allowing a remote attacker to trigger malicious file requests from a victim’s browser. This weakness corresponds to path traversal (CWE‑22) and insufficient cross‑origin protection (CWE‑346).

All Zurich Instruments LabOne installations that include the embedded Web Server component and are running a version prior to 26.01.3.9. The specified fix applies to these releases; installations that have upgraded to 26.01.3.9 or later are considered protected.

The vulnerability carries a CVSS score of 8.7, indicating high severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation requires that the Web Server be running and requires no authentication. The likely attack vectors include an attacker on the same internal network or a malicious website that a user visits while the LabOne host’s Web Server is active, both capable of triggering the vulnerable file‑access behavior. Successful exploitation would allow an attacker to read any files readable by the LabOne OS user, potentially compromising confidential or sensitive data.