CVE-2026-9166 is a path traversal flaw in the GIS Informatics GisLab Laboratory Management System, from version 1.4.03 up to but not including 1.5. NVD scores it High (7.5), with a network attack vector and no login required. Upgrade to 1.5 or later and read the national advisory.
What's affected
The NVD record says the issue affects GisLab Laboratory Management System from 1.4.03 before 1.5. That implies 1.5 as the fixed version, though the record does not say so in as many words.
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: reachable over the network with no login, and the impact is on confidentiality only. That points to files being read and not changed.
The only reference is a notice from the Turkish national cyber security authority (tr-26-1063). The page was not readable in our fetch, so we have not confirmed details beyond the record. Read the notice directly for vendor instructions and any workaround, and contact the vendor if you cannot find them.
How to check if you're exposed
Find the version of GisLab in your environment, in the application's about or settings page or from your installation records. A version between 1.4.03 and anything below 1.5 is affected.
Laboratory systems often hold sensitive records. Check whether the application is reachable from the internet or from broad internal networks, and look at web server logs for requests that include parent directory sequences or unusual file paths in parameters. Repeated requests like that are a sign of probing.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade GisLab to 1.5 or later after confirming the fix in the national notice or with the vendor.
- Restrict network access to the application to the people who need it, and put it behind a VPN or gateway.
- Ask a web application firewall to block requests with parent directory sequences while you schedule the upgrade.
- Review which files the application's account can read, and remove access to anything outside its own data.
- Check logs for earlier probing.
Why it matters
Path traversal happens when an application builds a file path from user input and does not confine the result to a safe folder. Adding parent directory sequences moves the path up and out of that folder and into places that were never meant to be served. The vector here shows only confidentiality impact, which fits a read of files such as configuration, credentials or stored records.
Because no login is needed, the exposure depends mostly on reachability. That is why network restrictions are a useful stopgap. The record's KEV flag is false and no source we could read reports exploitation.
Quick check
Which version is fixed?
The record scopes the issue to 1.4.03 before 1.5, so 1.5 is the first version outside the range. Confirm with the vendor or the national notice.
Why could we not read the advisory?
The notice page did not return readable text when we fetched it, so this post relies on the NVD record.
Sources
Last reviewed: 18 October 2026.
