CVE-2026-35403
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.
Risk Assessment
An attacker can steal session data or take over a user account if the user clicks a crafted link, leading to data confidentiality and integrity breaches.
Recommendation
Immediately upgrade LORIS to version 27.0.3 or 28.0.1, which contain the fix.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1.