CVE-2026-35400
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.
Risk Assessment
An attacker with access to the publication module can send phishing emails that appear to be official LORIS messages, potentially leading to data theft or further attacks.
Recommendation
Immediately update LORIS to version 27.0.3 or 28.0.1.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1.