Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M
CVE-2026-26985LORIS vulnerable to path traversal in electrophysiology_browser
High 8.1
In plain English
A high-severity path traversal in Loris from aces. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp x_refsource_CONFIRM
- https://github.com/aces/Loris/releases/tag/v26.0.5 x_refsource_MISC
- https://github.com/aces/Loris/releases/tag/v27.0.2 x_refsource_MISC