Path Traversal Vulnerability in Thermo Fisher Torrent Suite Django Application

CVE-2025-54307

What is CVE-2025-54307?

A vulnerability exists in the Thermo Fisher Torrent Suite Django application version 5.18.1 that permits low-privilege users to gain unauthorized file upload capabilities via specific endpoints. The plupload_file_upload function inadequately sanitizes the filename during the upload process, allowing malicious actors to exploit path traversal techniques. This flawed file handling can lead to arbitrary file writes on the server, potentially resulting in remote code execution, especially when overwriting critical executables. Notably, a compromised executable like pdflatex can be executed through subsequent requests, escalating the attack's impact.

References