CVE-2026-35169
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
LORIS (Longitudinal Online Research and Imaging System) before versions 27.0.3 and 28.0.1 contains a reflected cross-site scripting vulnerability in the help_editor module due to improper sanitization of user-supplied variables. An attacker can trick a user into following an invalid link, potentially resulting in script execution in the victim's browser. The same vector can also allow an attacker to download arbitrary markdown files on an unpatched server.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, potentially leading to session theft, data theft, or redirection to malicious sites. Additionally, arbitrary markdown files can be downloaded from the server.
Recommendation
Immediately update LORIS to version 27.0.3 or 28.0.1, which contain the fix.
Other vulnerabilities in LORIS
See all- CVE-2026-35446High
LORIS versions 24.0.0 through before 27.0.3 and 28.0.1 have a vulnerability due to incorrect order of operations in FilesDownloadHandler, allowing an attacker to escape intended download directories.
- CVE-2026-35403Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.
- CVE-2026-35400Low
In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.
- CVE-2026-35165Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.
- CVE-2026-34985Medium
LORIS versions 16.1.0 up to before 27.0.3 and 28.0.1 have a vulnerability in the media module. The backend does not check file access permissions, allowing unauthorized users to access files if they know the filename.
- CVE-2026-34392High
In LORIS (Longitudinal Online Research and Imaging System) from version 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router allows an attacker to traverse outside the intended directory and download unintended files through the static, css, and js endpoints. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
- CVE-2026-33350High
In LORIS (Longitudinal Online Research and Imaging System) prior to versions 27.0.3 and 28.0.1, a SQL injection has been identified in the MRI feedback popup window of the imaging browser. Attackers can use SQL injection to access or alter data on the server. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.