CVE-2026-55146

In LORIS versions from 22.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `imaging_browser` module API permits edits to imaging data without checking the frontend edit permissions. An authenticated API caller can modify imaging data without the required edit authorization.

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

LORIS versions 24.0.0 through before 27.0.3 and 28.0.1 have a vulnerability due to incorrect order of operations in FilesDownloadHandler, allowing an attacker to escape intended download directories.

In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.

In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.

LORIS (Longitudinal Online Research and Imaging System) before versions 27.0.3 and 28.0.1 contains a reflected cross-site scripting vulnerability in the help_editor module due to improper sanitization of user-supplied variables. An attacker can trick a user into following an invalid link, potentially resulting in script execution in the victim's browser. The same vector can also allow an attacker to download arbitrary markdown files on an unpatched server.

In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.

LORIS versions 16.1.0 up to before 27.0.3 and 28.0.1 have a vulnerability in the media module. The backend does not check file access permissions, allowing unauthorized users to access files if they know the filename.

In LORIS (Longitudinal Online Research and Imaging System) from version 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router allows an attacker to traverse outside the intended directory and download unintended files through the static, css, and js endpoints. This vulnerability is fixed in versions 27.0.3 and 28.0.1.

In LORIS (Longitudinal Online Research and Imaging System) prior to versions 27.0.3 and 28.0.1, a SQL injection has been identified in the MRI feedback popup window of the imaging browser. Attackers can use SQL injection to access or alter data on the server. This vulnerability is fixed in versions 27.0.3 and 28.0.1.