Aces Loris vulnerabilities

CVE-2026-26984 [HIGH] CWE-22 CVE-2026-26984: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to upload a malicious file to an arbitrary location on th

CVE-2026-33350 [HIGH] CWE-89 CVE-2026-33350: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter dat

CVE-2026-35446 [HIGH] CWE-552 CVE-2026-35446: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability i

CVE-2026-34392 [HIGH] CWE-552 CVE-2026-34392: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through t

CVE-2026-26985 [MEDIUM] CWE-22 CVE-2026-26985: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a

CVE-2026-34985 [MEDIUM] CWE-639 CVE-2026-34985: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would b

CVE-2026-35165 [MEDIUM] CWE-639 CVE-2026-35165: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could t

CVE-2026-39985 [MEDIUM] CWE-601 CVE-2026-39985: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbi

CVE-2026-35169 [MEDIUM] CWE-79 CVE-2026-35169: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user

CVE-2026-35403 [MEDIUM] CWE-79 CVE-2026-35403: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properl

CVE-2026-35400 [MEDIUM] CWE-59 CVE-2026-35400: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This