Vulnerability Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mcgill | Loris | >= 20.0.0, < 27.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/aces/Loris/security/advisories/GHSA-rfj5-58hv-wc5fPatchVendor Advisory
FAQ
What is CVE-2026-34392?
CVE-2026-34392 is a vulnerability with a CVSS score of 7.5 (HIGH). LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, ...
How severe is CVE-2026-34392?
CVE-2026-34392 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-34392?
Check the references section above for vendor advisories and patch information. Affected products include: Mcgill Loris.