CVE-2026-35446
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
LORIS versions 24.0.0 through before 27.0.3 and 28.0.1 have a vulnerability due to incorrect order of operations in FilesDownloadHandler, allowing an attacker to escape intended download directories.
Risk Assessment
Risk includes unauthorized access to files outside intended directories, potentially leading to data leakage.
Recommendation
Upgrade LORIS to version 27.0.3 or 28.0.1.
Other vulnerabilities in LORIS
See all- CVE-2026-35403Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.
- CVE-2026-35400Low
In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.
- CVE-2026-35169High
LORIS (Longitudinal Online Research and Imaging System) before versions 27.0.3 and 28.0.1 contains a reflected cross-site scripting vulnerability in the help_editor module due to improper sanitization of user-supplied variables. An attacker can trick a user into following an invalid link, potentially resulting in script execution in the victim's browser. The same vector can also allow an attacker to download arbitrary markdown files on an unpatched server.
- CVE-2026-35165Medium
In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.
- CVE-2026-34985Medium
LORIS versions 16.1.0 up to before 27.0.3 and 28.0.1 have a vulnerability in the media module. The backend does not check file access permissions, allowing unauthorized users to access files if they know the filename.
- CVE-2026-34392High
In LORIS (Longitudinal Online Research and Imaging System) from version 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router allows an attacker to traverse outside the intended directory and download unintended files through the static, css, and js endpoints. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
- CVE-2026-33350High
In LORIS (Longitudinal Online Research and Imaging System) prior to versions 27.0.3 and 28.0.1, a SQL injection has been identified in the MRI feedback popup window of the imaging browser. Attackers can use SQL injection to access or alter data on the server. This vulnerability is fixed in versions 27.0.3 and 28.0.1.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.