Vulnerability Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mcgill | Loris | >= 24.0.0, < 26.0.5 |
Related Weaknesses (CWE)
References
- https://github.com/aces/Loris/releases/tag/v26.0.5ProductRelease Notes
- https://github.com/aces/Loris/releases/tag/v27.0.2ProductRelease Notes
- https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhpVendor Advisory
FAQ
What is CVE-2026-26985?
CVE-2026-26985 is a vulnerability with a CVSS score of 8.1 (HIGH). LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to v...
How severe is CVE-2026-26985?
CVE-2026-26985 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26985?
Check the references section above for vendor advisories and patch information. Affected products include: Mcgill Loris.