CVE-2026-34392: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research…

PriorityP344high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.25%

16.2th percentile

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
aces	loris	—	—
aces	loris	—	—
mcgill	loris	—	—
mcgill	loris	>= 20.0.0 < 27.0.3	27.0.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.