CVE-2025-54307

CVE-2025-54307 is a path traversal vulnerability affecting Thermo Fisher Torrent Suite Django application version 5.18.1. Low-privilege users can upload ZIP files to specific endpoints, and due to improper sanitization of filenames, an authenticated attacker can write arbitrary files to the server. This allows for remote code execution by overwriting executable files, such as pdflatex. The vulnerability has a CVSS score of 8.8 (High), indicating a network-based attack with low privileges, leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.