CVE-2026-34392
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In LORIS (Longitudinal Online Research and Imaging System) from version 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router allows an attacker to traverse outside the intended directory and download unintended files through the static, css, and js endpoints. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
Risk Assessment
An attacker can download sensitive files from the server, potentially leading to data leakage.
Recommendation
Update LORIS to version 27.0.3 or 28.0.1.
Other vulnerabilities in LORIS
See all- CVE-2026-35446High
LORIS versions 24.0.0 through before 27.0.3 and 28.0.1 have a vulnerability due to incorrect order of operations in FilesDownloadHandler, allowing an attacker to escape intended download directories.
- CVE-2026-35403Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.
- CVE-2026-35400Low
In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.
- CVE-2026-35169High
LORIS (Longitudinal Online Research and Imaging System) before versions 27.0.3 and 28.0.1 contains a reflected cross-site scripting vulnerability in the help_editor module due to improper sanitization of user-supplied variables. An attacker can trick a user into following an invalid link, potentially resulting in script execution in the victim's browser. The same vector can also allow an attacker to download arbitrary markdown files on an unpatched server.
- CVE-2026-35165Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.
- CVE-2026-34985Medium
LORIS versions 16.1.0 up to before 27.0.3 and 28.0.1 have a vulnerability in the media module. The backend does not check file access permissions, allowing unauthorized users to access files if they know the filename.
- CVE-2026-33350High
In LORIS (Longitudinal Online Research and Imaging System) prior to versions 27.0.3 and 28.0.1, a SQL injection has been identified in the MRI feedback popup window of the imaging browser. Attackers can use SQL injection to access or alter data on the server. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.